CVE-2025-66630 - CVE House
Back to Database
Status published Critical CVE-2025-66630

Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure

Vulnerability Description

Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying crypto/rand implementation can return an error if secure randomness cannot be obtained. Because no error is returned by the Fiber v2 UUID functions, application code may unknowingly rely on predictable, repeated, or low-entropy identifiers in security-critical pathways. This is especially impactful because many Fiber v2 middleware components (session middleware, CSRF, rate limiting, request-ID generation, etc.) default to using utils.UUIDv4(). This vulnerability is fixed in 2.52.11.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66630

Credits & Attribution

No credits recorded in the NVD database.

References

More from gofiber

View All →
CVE-2025-66565
Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values
Critical 9.3
CVE-2025-54801
Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decoder
High 8.7
CVE-2025-48075
Fiber panics when fiber.Ctx.BodyParser parses invalid range index
High 7.7
CVE-2024-38513
Fiber Session Middleware Token Injection Vulnerability
Critical 10
CVE-2024-25124
Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials
Critical 9.4

Affected Vendor

Affected Software

fiber
Vulnerable Versions:
< 2.52.11

Timeline

Official Publish: February 9th, 2026
Last Modified: February 10th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-338

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.