CVE-2025-66630

The record

Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying crypto/rand implementation can return an error if secure randomness cannot be obtained. Because no error is returned by the Fiber v2 UUID functions, application code may unknowingly rely on predictable, repeated, or low-entropy identifiers in security-critical pathways. This is especially impactful because many Fiber v2 middleware components (session middleware, CSRF, rate limiting, request-ID generation, etc.) default to using utils.UUIDv4(). This vulnerability is fixed in 2.52.11.

Affected packages

Related vulnerabilities

• GO-2026-4471 Fiber has an insecure fallback in utils.UUIDv4() / utils.UUID() on crypto/rand failure in… Same vulnerability
• GO-2026-4543 Fiber has a Denial of Service Vulnerability via Route Parameter Overflow in… Also affects github.com/gofiber/fiber/v2
• CVE-2026-25882 Fiber is an Express inspired web framework written in Go. Also affects github.com/gofiber/fiber/v2
• CVE-2026-33809 A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB… Also affects gatus
• CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
• CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
• CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
• CVE-2026-34042 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb