\" + b + \"
\")\n case \"msgpack\":\n return r.MsgPack(body)\n case \"cbor\":\n return r.CBOR(body)\n }\n return r.SendString(b)\n}\n```\n## Impact\n\nThis impacts all current v3 releases ≤ 3.1.0 containing `DefaultRes.AutoFormat`, and all current v2 releases ≤ 2.52.12 where the identical `\"\" + b + \"
\"` construction exists in `(*Ctx).Format()`. Exploitation requires that an application call `c.AutoFormat(v)` where `v` (or a field stringified by `%v`) contains request-influenced data.\n\nA handler that uses `AutoFormat()` to serve multiple representations of the same data can be turned into an HTML XSS sink when the client sends `Accept: text/html`, even if the developer only tested the JSON path.\n\nThis may result in:\n- **Reflected XSS** in the application's origin via any request-derived value reaching `AutoFormat`.\n- **Stored XSS** where the reflected value originates from persisted input later passed to `AutoFormat`.\n\n## Proposed Patch\n\nThe injection surface is `r.Type(\"html\")` followed by `r.SendString(b)` with unescaped caller data, where it constructs markup on the caller's behalf around a value whose HTML-ness the caller did not declare. A few options:\n- `AutoFormat()` should treat `body` as data, not markup, in the `\"html\"` branch and escape it before concatenating it into the framework-generated `` wrapper. Callers that need raw negotiated HTML should use `Format()` with an explicit HTML handler.\n- Introduce a sibling method that escapes, leave `AutoFormat` alone for backward compatibility.\n\nHTML-escape the value in the \"html\" branch before concatenating it into the `
` wrapper.\n```go\nimport \"html\"\n\n// ...\ncase \"html\":\n return r.SendString(\"
\" + html.EscapeString(b) + \"
\")\n```\n\n`html.EscapeString` escapes `<`, `>`, `&`, `'`, `\"`, which is sufficient for an element-text context. Apply the same change to v2's `(*Ctx).Format()`.\n\n## Proof of Concept\n\n```bash\n# Create project directory\nmkdir fiber-xss-poc && cd fiber-xss-poc\n\n# Initialize Go module\ngo mod init fiber-xss-poc\n\n# Install Fiber v3\ngo get github.com/gofiber/fiber/v3\n\n# Create the PoC file\ncat > main.go << 'EOF'\npackage main\n\nimport (\n\t\"github.com/gofiber/fiber/v3\"\n)\n\ntype User struct {\n\tID int `json:\"id\"`\n\tName string `json:\"name\"`\n}\n\nfunc main() {\n\tapp := fiber.New()\n\t\n\tapp.Get(\"/api/user\", func(c fiber.Ctx) error {\n\t\tuser := User{\n\t\t\tID: 1,\n\t\t\tName: c.Query(\"name\", \"anonymous\"),\n\t\t}\n\t\treturn c.AutoFormat(user)\n\t})\n\n\tapp.Listen(\":3000\")\n}\nEOF\n\n# Run it\ngo run main.go\n}\n```\n\nBenign JSON\n```bash\ncurl -s 'http://127.0.0.1:3000/api/user?name=Alice' -H 'Accept: application/json'\n{\"id\":1,\"name\":\"Alice\"}\n```\n\nHTML sink enables XSS\n```bash\ncurl -s 'http://127.0.0.1:3000/api/user?name=' -H 'Accept: text/html'\n{1 }
\n```","affected":[{"package":{"name":"github.com/gofiber/fiber/v3","ecosystem":"Go","purl":"pkg:golang/github.com/gofiber/fiber/v3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.2.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 3.1.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-qjv7-627w-8qjv/GHSA-qjv7-627w-8qjv.json"}},{"package":{"name":"github.com/gofiber/fiber/v2","ecosystem":"Go","purl":"pkg:golang/github.com/gofiber/fiber/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.52.13"}]}],"database_specific":{"last_known_affected_version_range":"<= 2.52.12","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-qjv7-627w-8qjv/GHSA-qjv7-627w-8qjv.json"}}],"references":[{"type":"WEB","url":"https://github.com/gofiber/fiber/security/advisories/GHSA-qjv7-627w-8qjv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42554"},{"type":"PACKAGE","url":"https://github.com/gofiber/fiber"}],"database_specific":{"cwe_ids":["CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-05-05T20:13:23Z","nvd_published_at":"2026-05-11T23:19:48Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}