Fiber
CVE-2025-66630
CRITICAL
GHSA-68rr-p4fp-j59v
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Cryptographic PRNG selection
|
| Impact | CVSS 9.4 with patch. Fiber is a popular Go web framework. Predictable session tokens enable hijacking any user session. |
| Exploit ScenarioDerived | An attacker predicts session tokens generated by the weak PRNG and hijacks authenticated sessions of other users. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Go Fiber web framework before 2.52.11 has a weak PRNG vulnerability (on Go < 1.24) that makes session tokens predictable, enabling session hijacking.
Earlier versions of this analysis (1)
Weak PRNG in Fiber framework makes session tokens predictable.
RemediationAI
Update Fiber to 2.52.11+ or use Go 1.24+.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Fiber < 2.52.11 uses a CWE-338 cryptographically weak PRNG for session token generation on Go versions prior to 1.24, making tokens predictable.
Know when Fiber gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying crypto/rand implementation can return an error if secure randomness cannot be obtained. Because no error is returned by the Fiber v2 UUID functions, application code may unknowingly rely on predictable, repeated, or low-entropy identifiers in security-critical pathways. This is especially impactful because many Fiber v2 middleware components (session middleware, CSRF, rate limiting, request-ID generation, etc.) default to using utils.UUIDv4(). This vulnerability is fixed in 2.52.11.
Executive ViewAI
Fiber web framework versions prior to 2.52.11 running on Go versions before 1.24 face a critical vulnerability where cryptographic randomness failures could be exploited to compromise session security and authentication mechanisms. Organizations using affected Fiber deployments must immediately assess their Go version and Fiber version to determine exposure and prioritize patching.
Apply vendor patch. Additionally: (1) Upgrade Go runtime to version 1.24+, (2) If immediate patching is impossible, isolate affected Fiber services behind WAF with strict request validation, (3) Implement additional session validation and cryptographic verification layers, (4) Enforce network segmentation to limit lateral movement if compromise occurs, (5) Enhance logging and monitoring of authentication/randomness-related errors.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Affected Products (CPE)GitHub Advisory
Fiber is a web framework written in go. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Unbounded memory allocation in Fiber v3 (prior to 3.1.0) allows unauthenticated remote attackers to trigger denial of se
Fiber web framework versions 2 and 3 are vulnerable to denial of service attacks when processing requests to routes cont
Fiber web framework versions 3.0.0 and earlier on Windows contain a path traversal vulnerability that allows remote atta
Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a sessio
Fiber is an express inspired web framework written in Go. Rated high severity (CVSS 8.8), this vulnerability is remotely
Fiber is an express inspired web framework written in Go. Rated high severity (CVSS 8.8), this vulnerability is remotely
In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is
Fiber is an Express inspired web framework built in the go language. Rated medium severity (CVSS 5.3), this vulnerabilit
Fiber is an Express inspired web framework written in Go. Rated high severity (CVSS 8.7), this vulnerability is remotely
Fiber is an Express-inspired web framework written in Go. Rated high severity (CVSS 7.7), this vulnerability is remotely
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB