CVE-2025-66565 - CVE House

Back to Database

Status published Critical CVE-2025-66565

Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values

9.3 CVSS

Vulnerability Description

Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values, including the zero UUID "00000000-0000-0000-0000-000000000000". The vulnerability occurs through two related but distinct failure paths, both ultimately caused by crypto/rand.Read() failures, compromising the security of all Fiber applications using these functions for security-critical operations. This issue is fixed in version 2.0.0-rc.4.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66565

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from gofiber

View All →

Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure

Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decoder

Fiber panics when fiber.Ctx.BodyParser parses invalid range index

Fiber Session Middleware Token Injection Vulnerability

Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials

Affected Vendor

gofiber

View all reports →

Affected Software

utils

Vulnerable Versions:

github.com/gofiber/utils <= 1.2.0, github.com/gofiber/utils/v2 < 2.0.0-rc.4

Timeline

Official Publish: December 9th, 2025

Last Modified: December 9th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-252 CWE-331 CWE-338

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.