StackRadar

CVE-2026-42554

Medium

Advisory

Published 5 May 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.002
12th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
22
of 17,781 indexed, latest versions
Container images
23
deployed by those charts
Fix available
2 of 2
affected packages

Fiber vulnerable to XSS in AutoFormat Content Negotiation

Carried by container images the latest versions of 22 of 17,781 indexed charts deploy, on 23 images.

Affected packageAffected versionsFixed inImages
github.com/gofiber/fiber/v2golangv2.0.2, v2.22.0, v2.34.0, v2.34.1+9 more2.52.1322
github.com/gofiber/fiber/v3golangv3.1.03.2.01
OSV records
GHSA-qjv7-627w-8qjv
Also known as
GO-2026-5585

Charts affected

22 by stars
ChartLatestAffected imagesRadar Score
netris-controllernetrisai2.8.21 of 14See more

netris-controller netrisai 2.8.2

1 of the 14 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
netrisai/controller-web-session-generator:0.2.0a030a31289f4
github.com/gofiber/fiber/v2@v2.34.0
2.52.13

Open the chart page →

30,326
gatustwin1.5.01 of 1See more

gatus twin 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
twinproduction/gatus:v5.34.03fff895e77d3
github.com/gofiber/fiber/v2@v2.52.9
2.52.13

Open the chart page →

721
go-hello-world-chartgo-hello-worldVerified publisher1.8.31 of 1See more

go-hello-world-chart go-hello-world 1.8.3

1 of the 1 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
ghcr.io/wasilak/go-hello-world:1.8.366d353e7693f
github.com/gofiber/fiber/v2@v2.52.10
2.52.13

Open the chart page →

742
versitygwalpineworks0.1.21 of 1See more

versitygw alpineworks 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
versity/versitygw:v1.0.145192635d0353
github.com/gofiber/fiber/v2@v2.52.8
2.52.13

Open the chart page →

1,114
versitygw-webhook-pulsar-proxyalpineworks0.1.11 of 1See more

versitygw-webhook-pulsar-proxy alpineworks 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
ghcr.io/alpineworks/versitygw-webhook-pulsar-proxy:v1.0.06e9ced773732
github.com/gofiber/fiber/v2@v2.52.8
2.52.13

Open the chart page →

893
applause-btnduyet0.1.11 of 1See more

applause-btn duyet 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
duyetdev/applause-btn:latest25e59d223eaa
github.com/gofiber/fiber/v2@v2.0.2
2.52.13

Open the chart page →

2,636
netobserv-flowelastiflowVerified publisher0.11.01 of 1See more

netobserv-flow elastiflow 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
elastiflow/flow-collector:7.26.0fee67842e16b
github.com/gofiber/fiber/v2@v2.52.12
2.52.13

Open the chart page →

1,435
cbtgeneral-helm-chartsVerified publisher0.0.51 of 1See more

cbt general-helm-charts 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
ethpandaops/cbt:latest5377ffb3091a
github.com/gofiber/fiber/v3@v3.1.0
3.2.0

Open the chart page →

564
fasttrackmlgresearch0.1.01 of 1See more

fasttrackml gresearch 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
gresearch/fasttrackml:latest16d1228220fc
github.com/gofiber/fiber/v2@v2.52.4
2.52.13

Open the chart page →

1,391
kubetaghuseyinbabalVerified publisher1.0.21 of 2See more

kubetag huseyinbabal 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
ghcr.io/huseyinbabal/kubetag:lateste161eddc59a0
github.com/gofiber/fiber/v2@v2.52.10
2.52.13

Open the chart page →

1,276
mocktailhuseyinnurbaki0.2.11 of 1See more

mocktail huseyinnurbaki 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
hhaluk/mocktail:2.0.3350d19360038
github.com/gofiber/fiber/v2@v2.22.0
2.52.13

Open the chart page →

1,606
vcbackendi4trustVerified publisher0.0.81 of 1See more

vcbackend i4trust 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
wistefan/vcbackend:0.0.13bd436164b51
github.com/gofiber/fiber/v2@v2.40.1
2.52.13

Open the chart page →

1,848
gravity-initinvisiblVerified publisher1.0.91 of 1See more

gravity-init invisibl 1.0.9

1 of the 1 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
invisibl/gravity-init:v1.0.91a970f84178b
github.com/gofiber/fiber/v2@v2.34.1
2.52.13

Open the chart page →

2,006
kestra-starterkestraOfficialVerified publisher2.0.11 of 5See more

kestra-starter kestra 2.0.1

1 of the 5 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
versity/versitygw:v1.1.0f730e0dbc1ef
github.com/gofiber/fiber/v2@v2.52.10
2.52.13

Open the chart page →

5,455
bc-depositorykubebb0.0.31 of 1See more

bc-depository kubebb 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
hyperledgerk8s/bc-saas:v0.0.1-20230524d8bc31176257
github.com/gofiber/fiber/v2@v2.43.0
2.52.13

Open the chart page →

1,940
bc-explorerkubebb0.0.31 of 1See more

bc-explorer kubebb 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
hyperledgerk8s/bc-explorer:v202305041f1a06b61f18
github.com/gofiber/fiber/v2@v2.43.0
2.52.13

Open the chart page →

1,940
api-serverkubeshop0.11.161 of 2See more

api-server kubeshop 0.11.16

1 of the 2 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
kubeshop/testkube-api-server:0.11.160ad97f07a78b
github.com/gofiber/fiber/v2@v2.22.0
2.52.13

Open the chart page →

3,417
testkube-apikubeshop2.1.1621 of 2See more

testkube-api kubeshop 2.1.162

1 of the 2 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
kubeshop/testkube-api-server:2.1.162e97dc620d9b4
github.com/gofiber/fiber/v2@v2.52.5
2.52.13

Open the chart page →

1,663
cachelavaOfficialVerified publisher1.1.11 of 1See more

cache lava 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
ghcr.io/lavanet/lava/lavap:v2.5.089028adefcff
github.com/gofiber/fiber/v2@v2.52.5
2.52.13

Open the chart page →

1,378
nexus-tasksnexus-tasks2.0.01 of 5See more

nexus-tasks nexus-tasks 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
ghcr.io/ashvinbambhaniya/nexus-tasks-backend:2.0.0f80349eb018b
github.com/gofiber/fiber/v2@v2.52.6
2.52.13

Open the chart page →

3,798
security-smellssecurity-smells0.1.01 of 1See more

security-smells security-smells 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
durellirsd/security-smells-api:v17398aca4fc2e
github.com/gofiber/fiber/v2@v2.52.4
2.52.13

Open the chart page →

1,424
typhoontyphoonVerified publisher0.2.32 of 2See more

typhoon typhoon 0.2.3

2 of the 2 container images this version deploys carry CVE-2026-42554.

Container imageDigestPackageFixed in
ghcr.io/zeiss/typhoon/controller:0.2.34fdf4edfda45
github.com/gofiber/fiber/v2@v2.52.6
2.52.13
ghcr.io/zeiss/typhoon/typhoon-webhook:0.2.378f9b82050bc
github.com/gofiber/fiber/v2@v2.52.6
2.52.13

Open the chart page →

1,672

Container images carrying it

23 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
durellirsd/security-smells-api:v17398aca4fc2e
github.com/gofiber/fiber/v2@v2.52.4
2.52.13
1
duyetdev/applause-btn:latest25e59d223eaa
github.com/gofiber/fiber/v2@v2.0.2
2.52.13
1
elastiflow/flow-collector:7.26.0fee67842e16b
github.com/gofiber/fiber/v2@v2.52.12
2.52.13
1
ethpandaops/cbt:latest5377ffb3091a
github.com/gofiber/fiber/v3@v3.1.0
3.2.0
1
gresearch/fasttrackml:latest16d1228220fc
github.com/gofiber/fiber/v2@v2.52.4
2.52.13
1
hhaluk/mocktail:2.0.3350d19360038
github.com/gofiber/fiber/v2@v2.22.0
2.52.13
1
hyperledgerk8s/bc-explorer:v202305041f1a06b61f18
github.com/gofiber/fiber/v2@v2.43.0
2.52.13
1
hyperledgerk8s/bc-saas:v0.0.1-20230524d8bc31176257
github.com/gofiber/fiber/v2@v2.43.0
2.52.13
1
invisibl/gravity-init:v1.0.91a970f84178b
github.com/gofiber/fiber/v2@v2.34.1
2.52.13
1
kubeshop/testkube-api-server:0.11.160ad97f07a78b
github.com/gofiber/fiber/v2@v2.22.0
2.52.13
1
kubeshop/testkube-api-server:2.1.162e97dc620d9b4
github.com/gofiber/fiber/v2@v2.52.5
2.52.13
1
netrisai/controller-web-session-generator:0.2.0a030a31289f4
github.com/gofiber/fiber/v2@v2.34.0
2.52.13
1
twinproduction/gatus:v5.34.03fff895e77d3
github.com/gofiber/fiber/v2@v2.52.9
2.52.13
1
versity/versitygw:v1.0.145192635d0353
github.com/gofiber/fiber/v2@v2.52.8
2.52.13
1
versity/versitygw:v1.1.0f730e0dbc1ef
github.com/gofiber/fiber/v2@v2.52.10
2.52.13
1
wistefan/vcbackend:0.0.13bd436164b51
github.com/gofiber/fiber/v2@v2.40.1
2.52.13
1
ghcr.io/alpineworks/versitygw-webhook-pulsar-proxy:v1.0.06e9ced773732
github.com/gofiber/fiber/v2@v2.52.8
2.52.13
1
ghcr.io/ashvinbambhaniya/nexus-tasks-backend:2.0.0f80349eb018b
github.com/gofiber/fiber/v2@v2.52.6
2.52.13
1
ghcr.io/huseyinbabal/kubetag:lateste161eddc59a0
github.com/gofiber/fiber/v2@v2.52.10
2.52.13
1
ghcr.io/lavanet/lava/lavap:v2.5.089028adefcff
github.com/gofiber/fiber/v2@v2.52.5
2.52.13
1
ghcr.io/wasilak/go-hello-world:1.8.366d353e7693f
github.com/gofiber/fiber/v2@v2.52.10
2.52.13
1
ghcr.io/zeiss/typhoon/controller:0.2.34fdf4edfda45
github.com/gofiber/fiber/v2@v2.52.6
2.52.13
1
ghcr.io/zeiss/typhoon/typhoon-webhook:0.2.378f9b82050bc
github.com/gofiber/fiber/v2@v2.52.6
2.52.13
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.