gofiber/fiber · error

ErrInvalidPath

ErrInvalidPath

Error message

invalid path

What it means

The static middleware sanitizes request paths and uses invalidPathSentinel ("/__fiber_invalid__") as a marker for paths that cannot be safely resolved to a filesystem entry. When the cleaned path equals this sentinel (or otherwise fails validation), ErrInvalidPath is returned, preventing path-traversal and serving of unexpected resources.

Source

Thrown at middleware/static/static.go:23

	"errors"
	"fmt"
	"io/fs"
	"net/url"
	"os"
	pathpkg "path"
	"path/filepath"
	"slices"
	"strconv"
	"strings"
	"sync"

	"github.com/gofiber/utils/v2"
	"github.com/valyala/fasthttp"

	"github.com/gofiber/fiber/v3"
)

var ErrInvalidPath = errors.New("invalid path")

const invalidPathSentinel = "/__fiber_invalid__"

func bytesToPathString(p []byte) string {
	if bytes.IndexByte(p, '\\') >= 0 {
		b := make([]byte, len(p))
		copy(b, p)
		for i := range b {
			if b[i] == '\\' {
				b[i] = '/'
			}
		}
		return utils.UnsafeString(b)
	}

	return utils.UnsafeString(p)
}

View on GitHub (pinned to a105acad6c)

Solutions

1. Normalize and validate paths at the edge (reverse proxy / middleware) before they reach the static handler.
2. Return 400 for requests containing control characters or invalid percent-encoding.
3. Keep the static handler rooted at a dedicated prefix and disable directory listing if not needed.

Example fix

// before
app.Use("/files", static.New("./uploads"))

// after
app.Use("/files", func(c fiber.Ctx) error {
    if strings.ContainsAny(c.Path(), "\x00") {
        return fiber.NewError(fiber.StatusBadRequest)
    }
    return c.Next()
})
app.Use("/files", static.New("./uploads"))

p := c.Path()
if strings.ContainsAny(p, "\x00\r\n") || !utf8.ValidString(p) {
    return fiber.NewError(fiber.StatusBadRequest, "malformed path")
}

func isServablePath(p string) bool {
    return p != "" && !strings.ContainsAny(p, "\x00\r\n") && utf8.ValidString(p)
}

When it happens

Trigger: A request whose path, after cleaning/decoding, equals the invalid sentinel or otherwise cannot be normalized into a servable filesystem path (e.g., control characters, malformed percent-encoding, null bytes).

Common situations: URL-encoded path traversal attempts; clients sending raw bytes; misbehaving reverse proxies that forward un-normalized paths; symbolic-link or root-escape attempts.

Related errors

• client: HTTPS to HTTP redirect blocked
• csrf: token not found
• csrf: token invalid
• csrf: sec-fetch-site header invalid
• csrf: referer header missing

AI-assisted analysis of gofiber/fiber@a105acad6c (2026-08-11). Data as JSON: /api/errors/47342a880e9896ff. Report an issue: GitHub.