CVE-2026-25882
High · 7.5CVSS
7.5
EPSS
0.9%
Published
Feb 24, 2026
CISA due date
—
The record
Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability results from missing validation during route registration combined with an unbounded array write during request matching. Version 2.52.12 patches the issue in the v2 branch and 3.1.0 patches the issue in the v3 branch.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/gofiber/fiber/v2 | 0 | 2.52.12 |
| Go | github.com/gofiber/fiber/v3 | 0 | 3.1.0 |
| Chainguard | gatus | 0 | 5.35.0-r1 |
| Chainguard | gatus-fips | 0 | 5.35.0-r1 |
| Wolfi | gatus | 0 | 5.35.0-r1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260226T182644-150000.1.149.1 |
Related vulnerabilities
- GO-2026-4543 Fiber has a Denial of Service Vulnerability via Route Parameter Overflow in… Same vulnerability
- GO-2026-4471 Fiber has an insecure fallback in utils.UUIDv4() / utils.UUID() on crypto/rand failure in… Also affects github.com/gofiber/fiber/v2
- CVE-2025-66630 Fiber is an Express inspired web framework written in Go. Also affects github.com/gofiber/fiber/v2
- GO-2026-4540 Fiber has an Arbitrary File Read in Static Middleware on Windows in… Also affects github.com/gofiber/fiber/v3
- GO-2026-4534 Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation in… Also affects github.com/gofiber/fiber/v3
- CVE-2026-25891 Fiber is an Express inspired web framework written in Go. Also affects github.com/gofiber/fiber/v3
- CVE-2026-25899 Fiber is an Express inspired web framework written in Go. Also affects github.com/gofiber/fiber/v3
- CVE-2026-33809 A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB… Also affects gatus