CVE-2026-42554 Overview
CVE-2026-42554 is a Cross-Site Scripting (XSS) vulnerability in the Go Fiber web framework affecting versions prior to 2.52.12 and 3.1.0. The flaw resides in the AutoFormat() content negotiation feature. When a handler passes attacker-influenced data to AutoFormat(), a remote attacker can force HTML rendering by sending an Accept: text/html request header. Fiber then selects the raw HTML output branch based solely on the attacker-controlled Accept header, allowing arbitrary HTML or JavaScript injection. The issue is tracked as [CWE-79] and is fixed in Fiber 2.52.12 and 3.1.0.
Critical Impact
Remote attackers can inject arbitrary HTML or JavaScript into responses generated by handlers that pass user-influenced data to AutoFormat(), enabling client-side script execution in victim browsers.
Affected Products
- Go Fiber web framework versions prior to 2.52.12
- Go Fiber web framework versions prior to 3.1.0
- Go applications using the AutoFormat() content negotiation feature with attacker-influenced data
Discovery Timeline
- 2026-05-11 - CVE-2026-42554 published to NVD
- 2026-05-15 - Last updated in NVD database
Technical Details for CVE-2026-42554
Vulnerability Analysis
The vulnerability stems from how Fiber's AutoFormat() helper performs content negotiation. The function is designed to return data in a format matching the client's Accept header. When the client requests text/html, Fiber emits the supplied data as raw HTML without escaping or sanitization. The naming of AutoFormat() implies safe, format-agnostic serialization. Developers reasonably expect symmetric, safe encoding across all output branches. The HTML branch breaks this expectation by emitting unescaped content, creating a reflected XSS sink when handlers pass attacker-controlled input.
Root Cause
The root cause is inconsistent output encoding across the branches inside AutoFormat(). The JSON, XML, and text branches serialize data through encoders that neutralize active content. The HTML branch writes the value directly to the response body. The decision between these branches is driven entirely by the client-supplied Accept header, which is untrusted input. Developers who opt into content negotiation do not opt into raw HTML emission for any individual request.
Attack Vector
The attack requires no authentication and is exploitable over the network. An attacker crafts a request to any endpoint whose handler reflects user-influenced data through AutoFormat(). The attacker sets Accept: text/html and supplies a malicious payload through a query parameter, path segment, header, or body field that the handler forwards to AutoFormat(). Fiber returns the payload as HTML, and the victim's browser executes any embedded script. User interaction is required because the victim must visit the attacker-crafted URL or be redirected to it. See the GitHub Security Advisory GHSA-qjv7-627w-8qjv for additional technical context.
Detection Methods for CVE-2026-42554
Indicators of Compromise
- Inbound HTTP requests carrying Accept: text/html headers targeting JSON or API endpoints that normally return structured data.
- Request parameters containing HTML tags such as <script>, <img onerror=, or <svg onload= reflected back in response bodies.
- Server access logs showing 200 responses with Content-Type: text/html from routes intended to return JSON or plain text.
Detection Strategies
- Audit Go source code for calls to c.AutoFormat() where the argument originates from request input such as query parameters, form fields, headers, or path variables.
- Deploy a web application firewall rule that flags HTML-encoded payloads in request parameters paired with Accept: text/html headers on API routes.
- Use static analysis tools to trace data flow from fiber.Ctx accessors into AutoFormat() invocations.
Monitoring Recommendations
- Log and alert on responses where Content-Type switches based on Accept header negotiation for endpoints expected to return a fixed format.
- Monitor browser-side Content Security Policy (CSP) violation reports for unexpected inline script execution originating from application domains.
- Track Fiber framework versions across the application inventory and flag any deployments below 2.52.12 or 3.1.0.
How to Mitigate CVE-2026-42554
Immediate Actions Required
- Upgrade Fiber to version 2.52.12 for the v2 branch or 3.1.0 for the v3 branch.
- Identify and review every handler that calls AutoFormat() with user-derived data and replace it with explicit, type-safe response methods such as c.JSON() until patched.
- Apply HTML escaping with html/template or text/template for any field that may flow into an HTML response context.
Patch Information
The Fiber maintainers fixed CVE-2026-42554 in versions 2.52.12 and 3.1.0. The patch addresses the unsafe HTML emission branch inside AutoFormat(). Refer to the GitHub Security Advisory GHSA-qjv7-627w-8qjv for full remediation guidance and release notes.
Workarounds
- Replace c.AutoFormat(data) calls with explicit format handlers such as c.JSON(data) or c.SendString(data) when the response format is known in advance.
- Strip or restrict the Accept header at an upstream proxy so that text/html is not negotiated for API routes.
- Sanitize all user input passed to AutoFormat() using an HTML sanitization library such as bluemonday before invocation.
# Upgrade Fiber v2 to the patched release
go get github.com/gofiber/fiber/v2@v2.52.12
# Or upgrade to Fiber v3 patched release
go get github.com/gofiber/fiber/v3@v3.1.0
# Verify resolved version
go list -m github.com/gofiber/fiber/v2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
