CVE-2026-45045

Name of the Vulnerable Software and Affected Versions Fiber versions prior to 3.3.0 Fiber versions prior to 2.52.14

Description The BalancerForward proxy helper in middleware/proxy/proxy.go uses the Header.Add() function instead of Header.Set() when injecting the X-Real-IP header. This behavior appends the real client IP as a second value rather than replacing any existing value provided by a user. Consequently, upstream servers that read only the first X-Real-IP header may use an attacker-supplied spoofed IP for logging, rate limiting, and access control, potentially leading to IP ACL bypass, rate limit bypass, audit log poisoning, and geolocation bypass.

Recommendations Update Fiber to version 3.3.0 or later. Update Fiber to version 2.52.14 or later.