Fiber, a Go web framework, implements a cache middleware whose default key generator uses only the request path. As a result, requests to the same URL path but with different query parameters can share a cache key and return an incorrect cached response. This flaw risks exposing data intended for a different request, which is a form of data leakage. The weakness is identified as CWE‑436 (Incomplete Handling of Request Input Parameters).

Go Fiber v3, specifically versions 3.0 through 3.1.0, are affected. The vulnerability is fixed in releases after 3.1.0; users running any version of Fiber within that range must upgrade to a patched version to avoid the cache mix‑up.

The CVSS score is 6.5, indicating medium severity. There is no EPSS score available, so the likelihood of exploitation cannot be quantified from public data. The vulnerability is not listed in the CISA KEV catalog. The attack vector requires normal HTTP requests to the affected endpoint; an attacker can craft queries to trigger a cache hit on a previously generated response for a different set of query parameters, potentially causing unauthorized data disclosure.