Security Advisory
CVE-2026-53624
4.8
MEDIUM
Vulnerability Description
Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.Protocol() for https instead of c.Scheme(). This issue is fixed in version 3.4.0.
Published Date
July 8, 2026
Official Source
NIST NVD Advisory