CVE-2026-53624

Name of the Vulnerable Software and Affected Versions Fiber versions prior to 3.4.0

Description The helmet middleware in the Fiber web framework fails to set the Strict-Transport-Security (HSTS) response header, even when HSTSMaxAge is configured. This occurs because the logic in middleware/helmet/helmet.go incorrectly uses the c.Protocol() function to check for HTTPS connections. The c.Protocol() function returns the HTTP protocol version (such as HTTP/1.1 or HTTP/2.0) rather than the URL scheme. Consequently, the condition c.Protocol() == "https" always evaluates to false, rendering the HSTS protection inactive. This can leave users susceptible to SSL stripping attacks, protocol downgrades, and cookie theft over HTTP.

Recommendations Update Fiber to version 3.4.0. As a temporary workaround, restrict the use of the helmet middleware if HSTS is the only required security header until the update is applied.