Vulnerability · Published May 22, 2025 · Assigned by GitHub_M
CVE-2025-48075Fiber panics when fiber.Ctx.BodyParser parses invalid range index
High 7.7
In plain English
A high-severity security flaw in fiber from gofiber. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Fiber is an Express-inspired web framework written in Go. Starting in version 2.52.6 and prior to version 2.52.7, `fiber.Ctx.BodyParser` can map flat data to nested slices using `key[idx]value` syntax, but when idx is negative, it causes a panic instead of returning an error stating it cannot process the data. Since this data is user-provided, this could lead to denial of service for anyone relying on this `fiber.Ctx.BodyParser` functionality. Version 2.52.7 fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/gofiber/fiber | no fix listed | GO-2025-3706 |
| Go | github.com/gofiber/fiber/v2 | 2.52.7 | GHSA-hg3g-gphw-5hhm |
| Go | github.com/gofiber/fiber/v2 | 2.52.7 | GO-2025-3706 |
Affected products (as reported)
Weakness: CWE-129 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P