Read the docs
TI-2025-40976 Aliases CVE-2025-66565GHSA-m98w-cqp3-qcqr

Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values

Priority HIGH 81CWE-252Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values, including the zero UUID "00000000-0000-0000-0000-000000000000". The vulnerability occurs through two related but distinct failure paths, both ultimately caused by crypto/rand.Read() failures, compromising the security of all Fiber applications using these functions for security-critical operations. This issue is fixed in version 2.0.0-rc.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00468 40th percentileScored 2026-11-07
Fix Fixed github.com/gofiber/utils/v2 (Go): 2.0.0-rc.4github.com/gofiber/utils (Go): 1.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gofiberutilsgithub.com/gofiber/utils <= 1.2.0; github.com/gofiber/utils/v2 < 2.0.0-rc.4—No fix listedCNA
—github.com/gofiber/utils/v2 (Go)before 2.0.0-rc.42.0.0-rc.4Patch availableGHSA-m98w-cqp3-qcqr
—github.com/gofiber/utils (Go)before 1.2.01.2.0Patch availableGHSA-m98w-cqp3-qcqr
  • utils Vendorgofiber Affected github.com/gofiber/utils <= 1.2.0; github.com/gofiber/utils/v2 < 2.0.0-rc.4 Fixed in — No fix listed CNA
  • github.com/gofiber/utils/v2 (Go) Vendor— Affected before 2.0.0-rc.4 Fixed in 2.0.0-rc.4 Patch available GHSA-m98w-cqp3-qcqr
  • github.com/gofiber/utils (Go) Vendor— Affected before 1.2.0 Fixed in 1.2.0 Patch available GHSA-m98w-cqp3-qcqr

CPE configurations NVD · 19

CPEVersionsRoleVendor
cpe:2.3:a:gofiber:utils:*:*:*:*:*:go:*:*up to 1.2.0Vulnerablegofiber
cpe:2.3:a:gofiber:utils:2.0.0:beta1:*:*:*:go:*:*2.0.0 beta1Vulnerablegofiber
cpe:2.3:a:gofiber:utils:2.0.0:beta10:*:*:*:go:*:*2.0.0 beta10Vulnerablegofiber
cpe:2.3:a:gofiber:utils:2.0.0:beta11:*:*:*:go:*:*2.0.0 beta11Vulnerablegofiber
cpe:2.3:a:gofiber:utils:2.0.0:beta12:*:*:*:go:*:*2.0.0 beta12Vulnerablegofiber
cpe:2.3:a:gofiber:utils:2.0.0:beta13:*:*:*:go:*:*2.0.0 beta13Vulnerablegofiber
cpe:2.3:a:gofiber:utils:2.0.0:beta14:*:*:*:go:*:*2.0.0 beta14Vulnerablegofiber
cpe:2.3:a:gofiber:utils:2.0.0:beta2:*:*:*:go:*:*2.0.0 beta2Vulnerablegofiber
cpe:2.3:a:gofiber:utils:2.0.0:beta3:*:*:*:go:*:*2.0.0 beta3Vulnerablegofiber
cpe:2.3:a:gofiber:utils:2.0.0:beta4:*:*:*:go:*:*2.0.0 beta4Vulnerablegofiber
  • cpe:2.3:a:gofiber:utils:*:*:*:*:*:go:*:* Versions up to 1.2.0 Vulnerable ·gofiber
  • cpe:2.3:a:gofiber:utils:2.0.0:beta1:*:*:*:go:*:* Versions 2.0.0 beta1 Vulnerable ·gofiber
  • cpe:2.3:a:gofiber:utils:2.0.0:beta10:*:*:*:go:*:* Versions 2.0.0 beta10 Vulnerable ·gofiber
  • cpe:2.3:a:gofiber:utils:2.0.0:beta11:*:*:*:go:*:* Versions 2.0.0 beta11 Vulnerable ·gofiber
  • cpe:2.3:a:gofiber:utils:2.0.0:beta12:*:*:*:go:*:* Versions 2.0.0 beta12 Vulnerable ·gofiber
  • cpe:2.3:a:gofiber:utils:2.0.0:beta13:*:*:*:go:*:* Versions 2.0.0 beta13 Vulnerable ·gofiber
  • cpe:2.3:a:gofiber:utils:2.0.0:beta14:*:*:*:go:*:* Versions 2.0.0 beta14 Vulnerable ·gofiber
  • cpe:2.3:a:gofiber:utils:2.0.0:beta2:*:*:*:go:*:* Versions 2.0.0 beta2 Vulnerable ·gofiber
  • cpe:2.3:a:gofiber:utils:2.0.0:beta3:*:*:*:go:*:* Versions 2.0.0 beta3 Vulnerable ·gofiber
  • cpe:2.3:a:gofiber:utils:2.0.0:beta4:*:*:*:go:*:* Versions 2.0.0 beta4 Vulnerable ·gofiber
Show 9 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:gofiber:utils:2.0.0:beta5:*:*:*:go:*:*2.0.0 beta5Vulnerablegofiber
cpe:2.3:a:gofiber:utils:2.0.0:beta6:*:*:*:go:*:*2.0.0 beta6Vulnerablegofiber
cpe:2.3:a:gofiber:utils:2.0.0:beta7:*:*:*:go:*:*2.0.0 beta7Vulnerablegofiber
cpe:2.3:a:gofiber:utils:2.0.0:beta8:*:*:*:go:*:*2.0.0 beta8Vulnerablegofiber
cpe:2.3:a:gofiber:utils:2.0.0:beta9:*:*:*:go:*:*2.0.0 beta9Vulnerablegofiber
cpe:2.3:a:gofiber:utils:2.0.0:rc1:*:*:*:go:*:*2.0.0 rc1Vulnerablegofiber
cpe:2.3:a:gofiber:utils:2.0.0:rc2:*:*:*:go:*:*2.0.0 rc2Vulnerablegofiber
cpe:2.3:a:gofiber:utils:2.0.0:rc3:*:*:*:go:*:*2.0.0 rc3Vulnerablegofiber
cpe:2.3:a:gofiber:utils:2.0.0:rc4:*:*:*:go:*:*2.0.0 rc4Vulnerablegofiber
  • cpe:2.3:a:gofiber:utils:2.0.0:beta5:*:*:*:go:*:* Versions 2.0.0 beta5 Vulnerable ·gofiber
  • cpe:2.3:a:gofiber:utils:2.0.0:beta6:*:*:*:go:*:* Versions 2.0.0 beta6 Vulnerable ·gofiber
  • cpe:2.3:a:gofiber:utils:2.0.0:beta7:*:*:*:go:*:* Versions 2.0.0 beta7 Vulnerable ·gofiber
  • cpe:2.3:a:gofiber:utils:2.0.0:beta8:*:*:*:go:*:* Versions 2.0.0 beta8 Vulnerable ·gofiber
  • cpe:2.3:a:gofiber:utils:2.0.0:beta9:*:*:*:go:*:* Versions 2.0.0 beta9 Vulnerable ·gofiber
  • cpe:2.3:a:gofiber:utils:2.0.0:rc1:*:*:*:go:*:* Versions 2.0.0 rc1 Vulnerable ·gofiber
  • cpe:2.3:a:gofiber:utils:2.0.0:rc2:*:*:*:go:*:* Versions 2.0.0 rc2 Vulnerable ·gofiber
  • cpe:2.3:a:gofiber:utils:2.0.0:rc3:*:*:*:go:*:* Versions 2.0.0 rc3 Vulnerable ·gofiber
  • cpe:2.3:a:gofiber:utils:2.0.0:rc4:*:*:*:go:*:* Versions 2.0.0 rc4 Vulnerable ·gofiber

Remediation

  • Fix · GHSA-m98w-cqp3-qcqr github.com/gofiber/utils/v2 (Go) Fixed in 2.0.0-rc.4 Advisory →
  • Fix · GHSA-m98w-cqp3-qcqr github.com/gofiber/utils (Go) Fixed in 1.2.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66565
  2. 2026-10-03 Alias added: GHSA-m98w-cqp3-qcqr

References

Patch 1

Advisory 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences