Read the docs
TI-2025-34555 Aliases CVE-2025-54801GHSA-qx2q-88mx-vhg7

Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decoder

Priority HIGH 77CWE-789Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-789.

Summary

Fiber is an Express inspired web framework written in Go. In versions 2.52.8 and below, when using Fiber's Ctx.BodyParser to parse form data containing a large numeric key that represents a slice index (e.g., test.18446744073704), the application crashes due to an out-of-bounds slice allocation in the underlying schema decoder. The root cause is that the decoder attempts to allocate a slice of length idx + 1 without validating whether the index is within a safe or reasonable range. If the idx is excessively large, this leads to an integer overflow or memory exhaustion, causing a panic or crash. This is fixed in version 2.52.9.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00424 36th percentileScored 2026-11-07
Fix Fixed fiber (gofiber): 2.52.9github.com/gofiber/fiber/v2 (Go): 2.52.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gofiberfiberbefore 2.52.92.52.9Patch availableCNA
—github.com/gofiber/fiber/v2 (Go)before 2.52.92.52.9Patch availableGHSA-qx2q-88mx-vhg7
  • fiber Vendorgofiber Affected before 2.52.9 Fixed in 2.52.9 Patch available CNA
  • github.com/gofiber/fiber/v2 (Go) Vendor— Affected before 2.52.9 Fixed in 2.52.9 Patch available GHSA-qx2q-88mx-vhg7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gofiber:fiber:*:*:*:*:*:go:*:*before 2.52.9Vulnerablegofiber
  • cpe:2.3:a:gofiber:fiber:*:*:*:*:*:go:*:* Versions before 2.52.9 Vulnerable ·gofiber

Remediation

  • Fix · CNA fiber (gofiber) Fixed in 2.52.9
  • Fix · GHSA-qx2q-88mx-vhg7 github.com/gofiber/fiber/v2 (Go) Fixed in 2.52.9 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54801
  2. 2026-10-03 Alias added: GHSA-qx2q-88mx-vhg7

References

Patch 1

Advisory 2

Other 1

  • TI-2024-16578 Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials CVSS 3.1CRITICAL 9.8
  • TI-2025-30446 Fiber panics when fiber.Ctx.BodyParser parses invalid range index CVSS 4.0HIGH 7.7
  • TI-2026-23477 github.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters CVSS 3.1MEDIUM 6.5
  • TI-2026-20922 Fiber has a Denial of Service Vulnerability via Route Parameter Overflow CVSS 4.0MEDIUM 5.5
  • TI-2026-30834 Fiber: XSS in AutoFormat Content Negotiation CVSS 4.0MEDIUM 5.3
  • TI-2026-38670 Fiber: HSTS header never set in helmet middleware due to incorrect protocol check CVSS 3.1MEDIUM 4.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences