Fabio Security Update Addresses 1 Vulnerability
Tech GuruQuick Answer
Fabio 1.6.6 through 1.7.1 can let an unauthenticated client strip configured client-IP, TLS or request-ID headers before a request reaches the backend. This affects deployments that enable those headers and rely on them downstream. Update to 1.7.2; the earlier fix for CVE-2025-48865 does not cover this gap.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory Fabio versions and configured trust-header names, identify backend authorization or audit logic that uses them, and update all affected proxy instances to 1.7.2.
Last verified: 2026-09-23 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Fabio packages and release streams identified in the project advisories |
|---|---|
| Advisory | GHSA-fq95-v8xc-jm3v |
| CVE | CVE-2026-62987 |
| Project advisory publication | 2026-07-03 00:17:46 UTC |
| Recorded source timestamp (historical snapshot) | 2026-09-22 20:34:24 UTC |
| Affected versions | github.com/fabiolb/fabio >= 1.6.6, <= 1.7.1 |
| Fixed version | github.com/fabiolb/fabio 1.7.2 |
| CVSS base score | 5.8 (CVSS v3) |
| CVSS severity | Medium |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The earlier fix protects a hardcoded set of forwarded headers but omits operator-configured ClientIPHeader, TLSHeader and RequestID names. A client's Connection header can cause the reverse proxy to remove those newly set headers. Consequences depend on backend behavior: lost IP-based controls or audit data, missing TLS assertions, or broken request correlation.
What To Validate Now
- Inventory. Locate Fabio packages and release streams identified in the project advisories deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Check versions 1.6.6 through 1.7.1 and the
proxy.header.clientip,proxy.header.tlsandproxy.header.requestidoptions. They are empty by default. This gap concerns enabled custom headers, not the hardcoded forwarded headers already protected by the earlier fix. - Remediate. Apply github.com/fabiolb/fabio 1.7.2 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. In a controlled proxy/backend test, confirm configured client-IP, TLS and request-ID headers survive request processing and retain correct values. Verify backend access decisions and log correlation as well as ordinary HTTP/TLS traffic; no proxy lab test was performed here.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Do not disable required trust headers as a shortcut without reviewing the backend controls that depend on them. Check behavior when a required header is absent and preserve relevant logs if investigating earlier access. A missing header can weaken a configured control; it does not establish a universal backend authentication bypass.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
