Fiber’s helmet middleware fails to set the Strict‑Transport‑Security header when HSTSMaxAge is configured because it checks the protocol incorrectly. As a result, browsers do not receive HSTS directives and may continue to use plain HTTP, leaving the application vulnerable to traffic‑intercept or downgrade attacks. The weakness is identified as CWE‑319, a failure to respect the correct protocol and therefore the security of HTTPS communications is compromised. Fiber deployments that use the helmet middleware with HSTSMaxAge configured prior to version 3.4.0 are impacted. Deployments running these older releases in production environments that rely on the middleware for HTTPS enforcement are at risk.

Affected are deployments of the Gofiber Fiber web framework before version 3.4.0 that use the helmet middleware with HSTSMaxAge configured. These installations fail to set the Strict‑Transport‑Security header, resulting in browsers lacking the HSTS policy.

The CVSS score is 4.8 and the EPSS score is <1%, indicating a very low overall chance of exploitation. It is inferred that the attack vector is client‑side, allowing an attacker to serve a victim’s browser over plain HTTP and intercept or tamper with traffic. No credentials or privileged access are required; the flaw simply removes network‑level enforcement that protects HTTPS traffic.