CVE-2025-48075 Fiber panics when fiber.Ctx.BodyParser parses invalid range index
An attacker can cause a denial of service by sending negative range indices to the BodyParser function in the Fiber Go web framework.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-48075?
CVE-2025-48075 is a high-severity denial of service vulnerability in gofiber fiber, published on 22 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fiber is an Express-inspired web framework written in Go. Starting in version 2.52.6 and prior to version 2.52.7, `fiber.Ctx.BodyParser` can map flat data to nested slices using `key[idx]value` syntax, but when idx is negative, it causes a panic instead of returning an error stating it cannot process the data. Since this data is user-provided, this could lead to denial of service for anyone relying on this `fiber.Ctx.BodyParser` functionality. Version 2.52.7 fixes the issue.
Weakness: CWE-129
Which versions are affected by CVE-2025-48075?
4 open source packages ship an affected version, including github.com/gofiber/fiber/v2 and github.com/gofiber/fiber. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gofiber/fiber/v2 Go | From 2.52.6 | 2.52.7 |
github.com/gofiber/fiber/v2 Go | From 2.52.6 | 2.52.7 |
github.com/gofiber/fiber/v2 Go | From 2.52.6 | 2.52.7 |
github.com/gofiber/fiber Go | All versions | None |
Products include Gofiber Fiber.
How do I fix CVE-2025-48075?
Upgrade github.com/gofiber/fiber/v2 to 2.52.7 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-48075 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-48075 exists.
Other vulnerabilities in gofiber fiber
- CVE-2024-38513 Fiber Session Middleware Token Injection Vulnerability
- CVE-2023-45128 CSRF Token Reuse Vulnerability in fiber
- CVE-2024-25124 Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials
- CVE-2025-66630 Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure
- CVE-2025-54801 Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decoder
Sources
Also known as GHSA-hg3g-gphw-5hhm, GO-2025-3706.