gofiber up to 2.52.10 rand utils.UUIDv4 weak prng

Summaryinfo

A vulnerability marked as problematic has been reported in gofiber fiber up to 2.52.10. Affected by this issue is the function utils.UUIDv4 of the component rand. Performing a manipulation results in weak prng. This vulnerability is reported as CVE-2025-66630. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in gofiber fiber up to 2.52.10. This affects the function utils.UUIDv4 of the component rand. The manipulation with an unknown input leads to a weak prng vulnerability. CWE is classifying the issue as CWE-338. The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying crypto/rand implementation can return an error if secure randomness cannot be obtained. Because no error is returned by the Fiber v2 UUID functions, application code may unknowingly rely on predictable, repeated, or low-entropy identifiers in security-critical pathways. This is especially impactful because many Fiber v2 middleware components (session middleware, CSRF, rate limiting, request-ID generation, etc.) default to using utils.UUIDv4(). This vulnerability is fixed in 2.52.11.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-66630 since 12/05/2025. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1600.001 according to MITRE ATT&CK.

Upgrading to version 2.52.11 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch eb874b6f6c5896b968d9b0ab2b56ac7052cb0ee1 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• gofiber

Name

• fiber

Version

• 2.52.0
• 2.52.1
• 2.52.2
• 2.52.3
• 2.52.4
• 2.52.5
• 2.52.6
• 2.52.7
• 2.52.8
• 2.52.9
• 2.52.10

License

• open-source

Website

• Product: https://github.com/gofiber/fiber/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion