CVE-2026-53624CWE-319

Fiber: HSTS header never set in helmet middleware due to incorrect protocol check

Medium · published July 8, 2026

CVSS v3.1
4.8
EPSS
0%
Percentile
11.0
In the wild
Unconfirmed
What it is

Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.Protocol() for https instead of c.Scheme(). This issue is fixed in version 3.4.0.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00212 · 11.0th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2026-07-08T19:32Z
EPSS history
Timeline
  • 08 JUL 19:32Z
    Fiber: HSTS header never set in helmet middleware due to incorrect protocol check
    cvelistv5