EUVD-2026-335641

fkie_cve-2026-53624

Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.Protocol() for https instead of c.Scheme(). This issue is fixed in version 3.4.0.

GHSA-gv83-gqw6-9j2c — GoFiber never set HSTS header in helmet middleware due to incorrect protocol check

Affected: Go: github.com/gofiber/fiber

### Summary

The `helmet` middleware in gofiber/fiber never sets the `Strict-Transport-Security` (HSTS) response header, even when `HSTSMaxAge` is explicitly configured, because the condition check at `helmet.go:67` uses `c.Protocol()` — which returns the HTTP protocol version string (e.g., `"HTTP/1.1"`, `"HTTP/2.0"`) — instead of `c.Scheme()` — which returns the URL scheme (`"http"` or `"https"`). Since `c.Protocol()` never equals `"https"` in any real deployment, the HSTS header is permanently disabled, defeating the security protection.

### Details

**Root cause:** `middleware/helmet/helmet.go`, line 67:

```go if c.Protocol() == "https" && cfg.HSTSMaxAge != 0 { ```

`c.Protocol()` (defined at `req.go:865-867`) delegates to `fasthttp.Request.Header.Protocol()`, which returns the HTTP protocol version: - `"HTTP/1.1"` for HTTP/1.1 connections - `"HTTP/2.0"` for HTTP/2 connections

The correct method is `c.Scheme()` (defined at `req.go:844-862`), which returns: - `"http"` for plain HTTP connections - `"https"` for TLS connections

Since `"HTTP/1.1" != "https"` always evaluates to `true`, the entire HSTS block (lines 67-76) is dead code.

**Note on test coverage:** The existing helmet test (`helmet_test.go`) passes because it uses `ctx.Request.Header.SetProtocol("https")` to artificially force `Protocol()` to return `"https"`. However, `fasthttp.Request.Header.SetProtocol()` sets the HTTP version field, and real HTTP requests never have protocol `"https"` — they have `"HTTP/…

Most recent entries from all

EUVD-2026-335641

fkie_cve-2026-53624

GHSA-gv83-gqw6-9j2c — GoFiber never set HSTS header in helmet middleware due to incorrect protocol check