CVE-2026-62987: Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

September 22, 2026

The v1.6.6 fix for CVE-2025-48865 sweeps the client Connection header against a hardcoded allowlist protectHeaders (proxy/http_headers.go:28-36) containing only the 7 X-Forwarded family headers. Fabio also injects three operator-configured server-side trust headers that are NOT in that allowlist, so the original hop-by-hop stripping attack still works against them.

References

github.com/advisories/GHSA-fq95-v8xc-jm3v
github.com/fabiolb/fabio/commit/240526a8004077edad4fb96d25b382bfc3901357
github.com/fabiolb/fabio/releases/tag/v1.7.2
github.com/fabiolb/fabio/security/advisories/GHSA-fq95-v8xc-jm3v
nvd.nist.gov/vuln/detail/CVE-2026-62987

Code Behaviors & Features

Detect and mitigate CVE-2026-62987 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →