TI-2025-41024 Aliases CVE-2025-66630 GHSA-68rr-p4fp-j59v

Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure

MEDIUM 40CWE-338Published 2026-02-09 · Updated 2026-02-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · High · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying crypto/rand implementation can return an error if secure randomness cannot be obtained. Because no error is returned by the Fiber v2 UUID functions, application code may unknowingly rely on predictable, repeated, or low-entropy identifiers in security-critical pathways. This is especially impactful because many Fiber v2 middleware components (session middleware, CSRF, rate limiting, request-ID generation, etc.) default to using utils.UUIDv4(). This vulnerability is fixed in 2.52.11.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00527 44th percentileScored 2026-11-07

Fix Fixed fiber (gofiber): 2.52.11github.com/gofiber/fiber/v2 (Go): 2.52.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
gofiber	fiber	before 2.52.11	2.52.11	Patch available	CNA
—	github.com/gofiber/fiber/v2 (Go)	before 2.52.11	2.52.11	Patch available	GHSA-68rr-p4fp-j59v

fiber Vendorgofiber Affected before 2.52.11 Fixed in 2.52.11 Patch available CNA
github.com/gofiber/fiber/v2 (Go) Vendor— Affected before 2.52.11 Fixed in 2.52.11 Patch available GHSA-68rr-p4fp-j59v

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:gofiber:fiber::::::go::*	before 2.52.11	Vulnerable	gofiber
cpe:2.3:a:golang:go::-::::::*	before 1.24.0	Running on	Go standard library

cpe:2.3:a:gofiber:fiber:*:*:*:*:*:go:*:* Versions before 2.52.11 Vulnerable ·gofiber
cpe:2.3:a:golang:go:*:-:*:*:*:*:*:* Versions before 1.24.0 Running on ·Go standard library

Remediation

Fix · CNA fiber (gofiber) Fixed in 2.52.11
Fix · GHSA-68rr-p4fp-j59v github.com/gofiber/fiber/v2 (Go) Fixed in 2.52.11 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2025-66630
2026-10-03 Alias added: GHSA-68rr-p4fp-j59v

References

Patch 1

https://github.com/gofiber/fiber/commit/eb874b6f6c5896b968d9b0ab2b56ac7052cb0ee1

Advisory 2

Other 2

TI-2025-34555 Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decoder CVSS 4.0HIGH 8.7
TI-2024-16578 Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials CVSS 3.1CRITICAL 9.8
TI-2025-30446 Fiber panics when fiber.Ctx.BodyParser parses invalid range index CVSS 4.0HIGH 7.7
TI-2026-23477 github.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters CVSS 3.1MEDIUM 6.5
TI-2026-20922 Fiber has a Denial of Service Vulnerability via Route Parameter Overflow CVSS 4.0MEDIUM 5.5
TI-2026-30834 Fiber: XSS in AutoFormat Content Negotiation CVSS 4.0MEDIUM 5.3

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences