CRITICAL🇵🇱 Wersja polska

CVE-2025-66630

CVSS 9.2v4.0pub. 2026-02-09upd. 2026-02-28

Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying crypto/rand implementation can return an error if secure randomness cannot be obtained. Because no error is returned by the Fiber v2 UUID functions, application code may unknowingly rely on predictable, repeated, or low-entropy identifiers in security-critical pathways. This is especially impactful because many Fiber v2 middleware components (session middleware, CSRF, rate limiting, request-ID generation, etc.) default to using utils.UUIDv4(). This vulnerability is fixed in 2.52.11.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The `crypto/rand` function in Go may return an error when the system is unable to provide secure randomness. UUID generation functions in Fiber v2 (including `utils.UUIDv4()`) do not propagate this error to the calling code. As a result, when the randomness generator fails, the application may receive identifiers with low entropy, repeating identifiers, or completely predictable ones. The problem is particularly severe because `utils.UUIDv4()` is used by default by many middleware components — sessions, CSRF, rate limiting, and request ID generation.

Impact

An attacker can predict or guess session identifiers, CSRF tokens, or other values used in security mechanisms, which opens the door to session hijacking, bypassing CSRF protection, or circumventing rate limiting mechanisms.

Mitigation & patch

Update Fiber v2 to version 2.52.11 or later. It is also recommended to update the Go runtime environment to version 1.24 or later. Details are available in the official producer advisory: https://github.com/gofiber/fiber/security/advisories/GHSA-68rr-p4fp-j59v

Who is affected

Gofiber Fiber v2 before version 2.52.11, running on Go versions earlier than 1.24

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X