Vulnerability in Gofiber Fiber
CVE-2025-66630
Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying crypto/rand implementation can return an error if secure randomness cannot be obtained. Because no error is returned by the Fiber v2 UUID functions, application code may unknowingly rely on predictable, repeated, or low-entropy identifiers in security-critical pathways. This is especially impactful because many Fiber v2 middleware components (session middleware, CSRF, rate limiting, request-ID generation, etc.) default to using utils.UUIDv4(). This vulnerability is fixed in 2.52.11.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.4 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L.
EPSS exploit prediction
EPSS: 0.005 (40.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 40th percentile — 40.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: +0.000
Affected products
- Gofiber Fiber — versions < 2.52.11
- Golang Go
Weakness classification (CWE)
References
- github.com/gofiber/fiber/security/advisories/GHSA-68rr-p4fp-j59v (Vendor Advisory)
- github.com/gofiber/fiber/commit/eb874b6f6c5896b968d9b0ab2b56ac7052cb0ee1 (Patch)
- github.com/gofiber/fiber/releases/tag/v2.52.11 (Product, Release Notes)
Frequently asked questions
- What is CVE-2025-66630?
- CVE-2025-66630 is a critical-severity vulnerability in Gofiber Fiber, classified under Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). CVSS score: 9.4/10. Published 2026-02-09.
- How severe is CVE-2025-66630?
- Critical severity. CVSS v3 base score is 9.4 out of 10.