4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-53624

CVE-2026-53624: Fiber: HSTS header never set in helmet middleware due to incorrect protocol check

Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.Protocol() for https instead of c.Scheme(). This issue is fixed in version 3.4.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-53624

CVE-2026-53624:

4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/gofiber/fiber	go	<= 3.3.0	3.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided vulnerability information and the associated patch clearly identifies the root cause of the issue. The vulnerability description explicitly points out the incorrect use of c.Protocol() instead of c.Scheme() (or in this case, the wrapper c.Secure()) within the helmet middleware. The provided commit 04dd4e7754f61768fddccacc79057e416f13e6bf directly addresses this issue. The patch modifies the helmet.go file, changing the conditional check from c.Protocol() == "https" to c.Secure(). This change is located within the anonymous fiber.Handler function returned by helmet.New. In a Go runtime profile, this anonymous function would appear as helmet.New.func1. This function is the core of the middleware and is where the faulty logic resides, making it the vulnerable function. The commit also includes updates to tests to properly simulate HTTPS connections, further confirming the nature of the fix and the original flaw.

Vulnerable functions

helmet.New.func1

middleware/helmet/helmet.go

The vulnerability lies in an anonymous function (a fiber.Handler) returned by the `helmet.New` function. This handler incorrectly checks `c.Protocol() == "https"` to determine if a connection is secure. `c.Protocol()` returns the HTTP protocol version (e.g., "HTTP/1.1"), which will never equal "https". This causes the HSTS header to never be set, even when configured. The patch replaces this incorrect check with `c.Secure()`, which correctly determines if the connection is over HTTPS.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.