6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30246

CVE-2026-30246: github.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters

Fiber is a web framework for Go. In github.com/gofiber/fiber/v3 versions through 3.1.0, the default key generator in the cache middleware uses only the request path and does not include the query string. As a result, requests for the same path with different query parameters can share a cache key and receive the wrong cached response. This can cause response mix-up for query-dependent endpoints and may expose data intended for a different request. This issue is fixed after version 3.1.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30246

CVE-2026-30246:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/gofiber/fiber/v3	go	<= 3.1.0	3.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in Fiber's cache middleware, where the default cache key generation mechanism ignored the query string of incoming requests. This created a cache poisoning vulnerability, as requests for the same path but with different query parameters (e.g., /page?id=1 and /page?id=2) would be treated as identical for caching purposes, leading to incorrect content being served. The root cause was the default KeyGenerator function, which was configured to use only the request path (c.Path()) to create the cache key.

The analysis of the patches reveals that the fix involves replacing this simplistic default KeyGenerator with a new, more comprehensive one (defaultKeyGenerator). This new generator constructs the cache key by combining the request path with the canonicalized query string, among other request attributes. The primary vulnerable function is the anonymous middleware handler returned by cache.New(), as this is the runtime component that invokes the key generation logic for each request. The function defaultKeyGenerator is also identified as a key function, as it represents the patched logic that remediates the vulnerability.

Vulnerable functions

github.com/gofiber/fiber/v3/middleware/cache.New.func1

middleware/cache/cache.go

This anonymous function is the middleware handler returned by `cache.New()`. It is executed for each incoming request. In vulnerable versions, with the default configuration, this handler used a `KeyGenerator` that created the cache key using only the request's path, completely ignoring query parameters. This flaw allowed an attacker to poison the cache. For example, requests to `/api/user?id=1` and `/api/user?id=2` would generate the same cache key, causing the second user to receive the first user's data.

github.com/gofiber/fiber/v3/middleware/cache.defaultKeyGenerator

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.