Explore

Latest Releases
Registries
Security Advisories
CollectionsPreview

Theme

Contact© 2026 Release Alert

Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

© 2026 Release Alert

Privacy Policy
Terms of Service
Contact

CVE-2026-25891 — HIGH severity vulnerability | Release Alert

CVE-2026-25891

7.5

HIGHCVSS v3

Published

February 24, 2026

Affected

6 projects

Assigned by

GitHub

Severity scale

010

Description

Fiber is an Express inspired web framework written in Go. A Path Traversal (CWE-22) vulnerability in Fiber allows a remote attacker to bypass the static middleware sanitizer and read arbitrary files on the server file system on Windows. This affects Fiber v3 through version 3.0.0. This has been patched in Fiber v3 version 3.1.0.

GitHub⚡️ Express inspired web framework written in Go

>= 3.0.0, < 3.1.0NVD

NPMLightweight JavaScript inheritance library

>= 3.0.0, < 3.1.0NVD

@react-three/fiber

NPM

More on this CVE

NVD↗GitHub Advisory↗

A React renderer for Threejs

>= 3.0.0, < 3.1.0NVD

Crates.ioBasis of my Fabric server framework. Both are still experimental

>= 3.0.0, < 3.1.0NVD

NuGet GalleryA miniframework for .NET CORE. This mini framework can be used with MVC or WEB API frameworks.

>= 3.0.0, < 3.1.0NVD

RubyGemsFiber is an open source content engine for Ruby.

>= 3.0.0, < 3.1.0NVD