Fiber Files

🚀 New

• Add support for configuring the Regex engine on the router (#4254) Swap the compiler used for regex() route constraints. Assign a drop-in engine such as coregex.MustCompile for faster matching;Fiber reuses the compiled matcher across requests. go app := fiber.New(fiber.Config{ RegexHandler: coregex.MustCompile, // default: regexp.MustCompile }) https://docs.gofiber.io/api/fiber#regexhandler
• Host auth middleware (#4199) New hostauthorization middleware that validates the incoming Host header against an allowlist (exact host, .subdomain wildcard, CIDR range) to protect against DNS rebinding attacks. go app.Use(hostauthorization.New(hostauthorization.Config{ AllowedHosts: []string{"api.myapp.com", ".myapp.com", "10.0.0.0/8"}, })) https://docs.gofiber.io/middleware/hostauthorization
• Delegate implementation to fasthttp/prefork (#4210) Prefork now delegates to fasthttp's prefork package and adds PreforkRecoverThreshold (max child restarts before the master exits) and PreforkLogger to ListenConfig. https://docs.gofiber.io/api/fiber#preforkrecoverthreshold
• Add support for contextual logs (#4241) Render request-scoped fields in log.WithContext(c) by configuring a template with log.SetContextTemplate, reusing the middleware/logger engine (including ${value:key} for arbitrary context values). ```go log.MustSetContextTemplate(log.ContextConfig{Format: log.RequestIDFormat})

app.Get("/", func(c fiber.Ctx) error { log.WithContext(c).Info("start") // renders the request id return c.SendString("ok") }) ``` https://docs.gofiber.io/api/log#bind-context

• Add storage backed SharedState for prefork applications (#4243) A prefork-safe, storage-backed key/value store via app.SharedState() for data shared across workers/processes, with JSON/MsgPack/CBOR/XML helpers and automatic key namespacing. app.State() stays process-local. go app := fiber.New(fiber.Config{ SharedStorage: redis.New(), // any fiber.Storage shared across workers }) app.SharedState().SetJSON("config", cfg, 0) https://docs.gofiber.io/api/state#sharedstate-prefork-safe
• Add lightweight SSE middleware (#4239) A Fiber-native middleware/sse for Server-Sent Events: SSE headers, event/comment/retry frames, per-write flushing, heartbeats, Last-Event-ID access, and disconnect detection via stream.Context(). go app.Get("/events", sse.New(sse.Config{ Handler: func(c fiber.Ctx, stream *sse.Stream) error { return stream.Event(sse.Event{Name: "message", Data: fiber.Map{"message": "hello"}}) }, })) https://docs.gofiber.io/middleware/sse

🧹 Updates

• Add prefixes to unexported boolean fields (#4300)
• Improve error messages in SaveFileToStorage (#4173)
• Streamline request handler selection and context management for improved performance (#4233)

🐛 Fixes

• Preserve mounted sub-app regex handler during mount prefixing (#4308)
• Trim only one trailing dot in host normalization (#4307)
• Reject oversized unknown-length adaptor request bodies (#4306)
• Fix compress middleware's shouldSkip method to avoid memory growth (#4284)
• Reject malformed host authorities in hostauthorization (#4293)
• Synchronize view reloads with template rendering (#4288)
• Avoid panic for non-struct listeners in TLS config discovery (#4305)
• Clear plaintext cookie when encryption fails (#4303)
• Fix regex route constraint parsing with literal > (#4292)
• Reject empty normalized host before dynamic matching (#4291)
• Preserve idempotency replay protection for oversized responses (#4287)
• Enforce CookieJar domain acceptance and host-only cookie matching (#4282)
• Avoid panic when reading released Fiber context values (#4271)
• Enforce static root for fs-backed directory serving (#4277)
• Prevent negative paginate start overflow (#4272)
• Prevent SharedState namespace key collisions (#4274)
• Copy FullURL string before returning pooled buffer (#4275)
• Enforce paginate sort allowlist when AllowedSorts is unset (#4276)
• Validate and safely apply workflow version updates (#4273)
• Close BodyStream in adaptor FiberHandler streaming path (#4267)
• Prevent panic when MsgPack is not configured (#4268)
• Keep IsFromLocal loopback-only and add unix-socket helper (#4270)
• Prevent panic when CBOR is not explicitly configured (#4269)
• Guard session logger tag against released middleware (#4265)
• Add X-Real-IP protection to Forward and DomainForward variants (#4261)
• Ensure BalancerForward overwrites X-Real-IP header (#4260)
• Add test coverage for multipart BodyLimit error handling (#4237)
• Improve error propagation in Express-style handler (#4250)
• Remove SSE Next and clarify SSE handler docs (#4247)
• BasicAuth verifier for unknown users (#4245)

🛠️ Maintenance

📚 Documentation

• Fix invalid RouteChain method chaining example (#4304)
• Harden reverse proxy X-Forwarded-For example (#4266)
• Correct fasthttpctx Done semantics in context guide (#4264)
• Clarify ${bytesSent} behavior in logger middleware (#4251)
• Clarify prefork security model and OS-specific socket behavior (#4240)

📒 Documentation: https://docs.gofiber.io/next/

💬 Discord: https://gofiber.io/discord

Full Changelog: https://github.com/gofiber/fiber/compare/v3.2.0...v3.3.0

Thank you @ReneWerner87, @elton-peixoto-lu, @gaby, @gtoxlili, @lyyvalhalla, @mutantkeyboard, @pageton and @pratikramteke for making this release possible.