Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream servers for logging, rate limiting, and access control. This issue is fixed in version 3.3.0 and 2.52.14.

Affected: Go: github.com/gofiber/fiber/v3, Go: github.com/gofiber/fiber/v2

## Summary

The `BalancerForward` proxy helper in GoFiber uses `Header.Add()` instead of `Header.Set()` when injecting the `X-Real-IP` header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first `X-Real-IP` header (nginx, Express, most HTTP servers) use the attacker's spoofed IP for logging, rate limiting, and access control.

## Vulnerable Code

**File:** `middleware/proxy/proxy.go`, lines 270-285

```go func BalancerForward(servers []string, clients ...*fasthttp.Client) fiber.Handler { r := &roundrobin{ current: 0, pool: servers, } return func(c fiber.Ctx) error { server := r.get() if !strings.HasPrefix(server, "http") { server = "http://" + server } c.Request().Header.Add("X-Real-IP", c.IP()) // line 282: Add, not Set return Do(c, server+c.OriginalURL(), clients...) } } ```

## Data Flow

1. Attacker sends request with `X-Real-IP: 10.0.0.1` (spoofed internal IP) 2. `BalancerForward` handler executes at line 282 3. `c.Request().Header.Add("X-Real-IP", c.IP())` APPENDS the real IP as a second header 4. Upstream server receives: `X-Real-IP: 10.0.0.1` AND `X-Real-IP: <real-attacker-ip>` 5. Most HTTP servers (nginx, Node.js, Apache) read the FIRST value 6. Upstream uses `10.0.0.1` for all IP-dependent logic

## Impact

- **Rate limit bypass:** IP-based rate limiting at the upstream uses the spoofed…