## Ticket: CVE-2026-30246 — Fiber v3 cache middleware key collision

**Advisory**: GHSA-35hp-hqmv-8qg8 — https://github.com/gofiber/fiber/security/advisories/GHSA-35hp-hqmv-8qg8
**CVE**: CVE-2026-30246 | **CWE-200 / CWE-524** (Information Exposure / Cache Confusion)
**Severity**: Medium — CVSS 3.1 base 6.5
**Package**: `github.com/gofiber/fiber/v3` (Go module) | **Repository**: https://github.com/gofiber/fiber

### Impact

The default `KeyGenerator` of Fiber v3's `cache` middleware returns only
`c.Path()`. The cache key therefore ignores the query string and any other
request component that distinguishes one user's request from another's.

Two requests to the same path with different query strings collide on the
cache key: the second request returns the **first user's cached response**,
leaking that response across users (cache confusion / information disclosure).

### Affected / fixed versions

Affected: `github.com/gofiber/fiber/v3` `<= 3.1.0`.
Fixed: **`3.2.0`**.

Reproduce on a vulnerable build (**`3.1.0`**) and verify the fix on
**`3.2.0`**.

### Where to look

The fix ships in commits
[`050ff1ff18511c1475b8ec627460216aaecddd4e`](https://github.com/gofiber/fiber/commit/050ff1ff18511c1475b8ec627460216aaecddd4e)
and
[`9a0d12c07ed895b84c72987f9288b04137afe5de`](https://github.com/gofiber/fiber/commit/9a0d12c07ed895b84c72987f9288b04137afe5de).
Inspect the patches to confirm the root cause and the new default
`KeyGenerator` behavior:

```bash
git clone https://github.com/gofiber/fiber.git
cd fiber && git show 050ff1ff18511c1475b8ec627460216aaecddd4e \
                 9a0d12c07ed895b84c72987f9288b04137afe5de
```

### Reproduction approach

No external services are needed — the bug is observable from one Go process
making two local HTTP requests.

1. In a scratch Go module, install the **vulnerable** build:
   `go get github.com/gofiber/fiber/v3@v3.1.0`
2. Write a tiny Go program that:
   - registers a handler returning the `id` query parameter as the response
     body,
   - wraps that route with `cache.New()` (default `KeyGenerator`),
   - starts the server on a local port,
   - issues `GET /?id=1` then `GET /?id=2`,
   - prints both response bodies.
3. Repeat with the **fixed** build:
   `go get github.com/gofiber/fiber/v3@v3.2.0`.

### Expected result

| Build | `GET /?id=1` then `GET /?id=2` |
|-------|---------------------------------|
| `fiber/v3@v3.1.0` (vulnerable) | `1` then **`1`** — cache key collides on `c.Path()` |
| `fiber/v3@v3.2.0` (fixed) | `1` then **`2`** — cache key distinguishes the requests |

- **Vulnerable indicator**: the second response body is `1` (the first
  user's cached body), proving cross-user leakage.
- **Fixed indicator**: the second response body is `2` (the request's own
  output).

### Expected artifacts

- `reproduction_steps.sh` — builds the Go PoC against both versions, runs
  it, and captures the two response bodies for each build.
- `validation_verdict.json` — `verdict: confirmed`, with the vulnerable and
  fixed indicators captured.
- Logs capturing the response bodies for `v3.1.0` and `v3.2.0`.