CVE-2025-48865: fabiolb fabio · Insufficient Verification of Data Authenticity
Affects fabiolb fabioSource CVE Database V5
Not known to be exploited · CVSS 9.1 Critical : upgrade to 1.6.6 as a priority.
Data as of 26 Oct 2026, 10:12 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 38% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 1.6.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitation evidence
Disclosed: evidence found.
CVE published 30 May 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade fabiolb/fabio to 1.6.6.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHubfabiolb/fabiopkg:github/fabiolb/fabioOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
- Immediate upgrade of fabio to version 1.6.6 or later, where the vulnerability is patched, is the most effective mitigation.
- Implement strict validation and sanitization of X-Forwarded-* headers at backend application layers, treating these headers as untrusted input unless originating from a trusted proxy.
- Configure network-level controls to restrict direct client access to fabio instances, ensuring only trusted internal services can communicate with the router.
- Employ Web Application Firewalls (WAFs) or API gateways that can detect and block suspicious header manipulations or malformed HTTP Connection headers.
- Monitor logs for unusual patterns in X-Forwarded headers or Connection header usage that could indicate exploitation attempts.
- Conduct security assessments and penetration testing focusing on header manipulation attacks to validate the effectiveness of mitigations.
- Educate development and operations teams about the risks of trusting forwarded headers and encourage secure coding practices that do not rely solely on these headers for critical security decisions.
Description
Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. Prior to version 1.6.6, Fabio allows clients to remove X-Forwarded headers (except X-Forwarded-For) due to a vulnerability in how it processes hop-by-hop headers. Fabio adds HTTP headers like X-Forwarded-Host and X-Forwarded-Port when routing requests to backend applications. Since the receiving application should trust these headers, allowing HTTP clients to remove or modify them creates potential security vulnerabilities. Some of these custom headers can be removed and, in certain cases, manipulated. The attack relies on the behavior that headers can be defined as hop-by-hop via the HTTP Connection header. This issue has been patched in version 1.6.6.