EUVD-2026-308590

fkie_cve-2026-30246

Fiber is a web framework for Go. In github.com/gofiber/fiber/v3 versions through 3.1.0, the default key generator in the cache middleware uses only the request path and does not include the query string. As a result, requests for the same path with different query parameters can share a cache key and receive the wrong cached response. This can cause response mix-up for query-dependent endpoints and may expose data intended for a different request. This issue is fixed after version 3.1.0.

GHSA-35hp-hqmv-8qg8 — Fiber's cache middleware default key generator ignores query string, causing response mix-up across distinct query para…

Affected: Go: github.com/gofiber/fiber/v3

### Summary Fiber cache middleware's default key generator uses only `c.Path()` and does not include the query string. As a result, requests like `/?id=1` and `/?id=2` can map to the same cache key and share the same cached response.

This can cause response mix-up (cache poisoning-like behavior) for endpoints where response content depends on query parameters.

### Details Default configuration in cache middleware:

- `KeyGenerator: func(c fiber.Ctx) string { return utils.CopyString(c.Path()) }`

References: - https://github.com/gofiber/fiber/blob/main/middleware/cache/config.go#L90-L92 - https://github.com/gofiber/fiber/blob/main/middleware/cache/cache_test.go#L599-L621

The existing test demonstrates that when handler output depends on query parameter `id`, a second request with a different query still returns the first cached response (cache hit), confirming query is not part of the default cache key.

### PoC Minimal PoC:

```go package main

import ( "log"

"github.com/gofiber/fiber/v3" "github.com/gofiber/fiber/v3/middleware/cache" )

func main() { app := fiber.New() app.Use(cache.New()) // default config

app.Get("/", func(c fiber.Ctx) error { return c.SendString(c.Query("id", "1")) })

log.Fatal(app.Listen(":3000")) } ```

Reproduction:

1. `GET /?id=1` - Cache miss - Response body: `1` 2. `GET /?id=2` - Cache hit - Response body: `1` (expected `2`)

Local verification command used:

```bash go test ./middleware/ca…

Most recent entries from all

EUVD-2026-308590

fkie_cve-2026-30246

GHSA-35hp-hqmv-8qg8 — Fiber's cache middleware default key generator ignores query string, causing response mix-up across distinct query para…