The BalancerForward helper in the Fiber framework injects the client IP into the X‑Real‑IP header using Header.Add instead of Header.Set. This behavior allows an attacker to include a malicious X‑Real‑IP value that becomes the first entry in the header when the request is forwarded to an upstream server. The forwarded header can then be used by upstream applications for logging, rate limiting, or IP‑based access control, leading to false attribution of requests, bypass of rate limits, or evasion of IP‑restricted access.

The vulnerability affects the Go Fiber framework provided by the gofiber vendor, specifically versions older than 3.3.0 and 2.52.14. Versions 3.3.0 and 2.52.14 onward use Header.Set to correctly set the X‑Real‑IP header and are not affected.

The assessed CVSS score of 5.3 places the flaw in the moderate range, while the EPSS score of <1% indicates a very low probability of exploitation. Because it is triggered by an arbitrary X‑Real‑ remote and does not require local privileges. If an attacker succeeds, they can spoof the client IP seen by upstream services, potentially causing misattributionbased rate limits, or bypass of IP‑based access controls. The flaw is not listed in, suggesting no publicly known exploits.