{
  "ticket_id": "CVE-2026-30246",
  "code_root": "external/fiber",
  "source": {
    "type": "cve",
    "cve_id": "CVE-2026-30246",
    "advisory_id": "GHSA-35hp-hqmv-8qg8",
    "advisory_url": "https://github.com/gofiber/fiber/security/advisories/GHSA-35hp-hqmv-8qg8",
    "vendor": "gofiber",
    "product": "fiber",
    "repo": "https://github.com/gofiber/fiber"
  },
  "facts": {
    "cve_id": "CVE-2026-30246",
    "advisory_id": "GHSA-35hp-hqmv-8qg8",
    "issue_summary": "The default KeyGenerator of Fiber v3's cache middleware returns only c.Path(), so two requests with different query strings (or other request-distinguishing inputs) share the same cache key. The second user's request returns the first user's cached response — a cross-user data leak / cache confusion.",
    "vulnerability_type": "Cache Confusion / Information Disclosure",
    "suspected_cwe": ["CWE-200", "CWE-524"],
    "affected_versions": "<= 3.1.0",
    "fixed_versions": ["3.2.0"],
    "reproduce_version": "3.1.0",
    "verify_fixed_version": "3.2.0",
    "repo_url": "https://github.com/gofiber/fiber.git",
    "fix_commits": [
      "050ff1ff18511c1475b8ec627460216aaecddd4e",
      "9a0d12c07ed895b84c72987f9288b04137afe5de"
    ],
    "code_root": "external/fiber",
    "ecosystem": "go",
    "package": "github.com/gofiber/fiber/v3",
    "affected_components": ["middleware/cache (default KeyGenerator)"],
    "install_recipe": "In a scratch Go module run `go get github.com/gofiber/fiber/v3@v3.1.0` (vulnerable) or `go get github.com/gofiber/fiber/v3@v3.2.0` (fixed). The Go module proxy is the canonical artifact; git tags v3.1.0 / v3.2.0 on the repo are equivalent.",
    "attacker_access": "Any second user whose request hits a path already cached for another user — typically anonymous reachability to the cached endpoint.",
    "primary_entry_point": "Any HTTP route handler wrapped with the default fiber/v3 cache middleware whose response varies with the query string (or other non-path input)",
    "exploit_outline": "A tiny Go program using fiber/v3 with a handler that returns the `id` query parameter and `cache.New()` middleware mounted on the route. Issue `GET /?id=1` then `GET /?id=2`. On the vulnerable build the second response is the cached body of the first.",
    "vulnerable_indicator": "GET /?id=1 returns `1`; GET /?id=2 returns `1` (cache key collision on c.Path()).",
    "fixed_indicator": "GET /?id=1 returns `1`; GET /?id=2 returns `2` (cache key now distinguishes the requests).",
    "reproduction_requirements": "Go toolchain (1.21+ recommended by fiber/v3) and the fiber/v3 module at the specified version. No database or external service; the entire reproduction runs as one Go process making two local HTTP requests.",
    "notes": "Two fix commits ship the change: 050ff1ff18511c1475b8ec627460216aaecddd4e and 9a0d12c07ed895b84c72987f9288b04137afe5de. The vulnerability is purely in the default KeyGenerator's input; user-supplied KeyGenerators that already include the query/body are unaffected."
  }
}