CVE-2026-62987: Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

September 22, 2026

The v1.6.6 fix for CVE-2025-48865 sweeps the client Connection header against a hardcoded allowlist protectHeaders (proxy/http_headers.go:28-36) containing only the 7 X-Forwarded family headers. Fabio also injects three operator-configured server-side trust headers that are NOT in that allowlist, so the original hop-by-hop stripping attack still works against them.

References

github.com/advisories/GHSA-fq95-v8xc-jm3v
github.com/fabiolb/fabio/commit/240526a8004077edad4fb96d25b382bfc3901357
github.com/fabiolb/fabio/releases/tag/v1.7.2
github.com/fabiolb/fabio/security/advisories/GHSA-fq95-v8xc-jm3v
nvd.nist.gov/vuln/detail/CVE-2026-62987

Code Behaviors & Features

Detect and mitigate CVE-2026-62987 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →