CVE-2025-66565
Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values, including the zero UUID "00000000-0000-0000-0000-000000000000". The vulnerability occurs through two related but distinct failure paths, both ultimately caused by crypto/rand.Read() failures, compromising the security of all Fiber applications using these functions for security-critical operations. This issue is fixed in version 2.0.0-rc.4.
- CVSS 4.0
- 9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-252, CWE-338, CWE-331
- Published
- Modified
- Record from
- the NVD, synced
Affected
- gofiber:utils
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m98w-cqp3-qcqr | Go | github.com/gofiber/utils/v2 | <2.0.0-rc.4 | 2.0.0-rc.4 |
| GHSA-m98w-cqp3-qcqr | Go | github.com/gofiber/utils | <1.2.0 | 1.2.0 |
| GO-2025-4208 | Go | github.com/gofiber/utils | <1.2.0 | 1.2.0 |
| GO-2025-4208 | Go | github.com/gofiber/utils/v2 | <2.0.0-rc.4 | 2.0.0-rc.4 |