CodeVetter · Repo Unpack · Risk map
gofiber/fiber
The findings below are source-observed boundaries and configuration hazards, not confirmed vulnerabilities. Request/context lifetime and network-client reuse have especially broad consequences. Several protections deliberately depend on application choices, including cookie attributes, proxy clients, error handlers, and filesystem destinations. Source inspection cannot establish whether consumer applications configure these boundaries correctly.
- Default context values can alias buffers reused by later requests; Immutable changes conversion behavior, but retaining the pooled Ctx itself still violates its documented lifetime.
- DefaultCtx.Done returns nil and Err returns nil regardless of SetContext; session load/save paths pass fiber.Ctx to Storage, so those calls do not inherit c.Context() cancellation through the default Ctx interface.
- Session defaults use secure token generation, Lax SameSite, and a 30-minute idle timeout, but CookieSecure and CookieHTTPOnly default false; SameSite=None alone forces Secure.
- Proxy guards document two limits: previously cached HostClients on a per-call client may predate guarding, and a custom Balancer LBClient leaves underlying dialer protection to the caller. AllowPrivateIPs, AllowHTTPSDowngrade, and KeepHopByHopHeaders explicitly relax protections.
- SaveFile checks only for a nil file header before passing the caller's destination path to fasthttp.SaveMultipartFile; static serving separately sanitizes routed paths. Upload destination confinement must therefore be enforced by the application.
- SkipUnmatchedRoutes can return 404/405 before entering middleware, except CORS preflight; middleware-based logging or policy side effects therefore need evaluation when enabling that option.
- Timeout handlers run in goroutines; default contexts are reclaimed only after both completion signals, while custom contexts explicitly remain outside the pool. Outbound client cancellation also allows transport work to finish asynchronously.
- DefaultErrorHandler returns err.Error() in the HTTP body, including non-Fiber errors; internal storage/proxy errors can reach this boundary unless the application supplies a different error handler.