CVE-2025-54801 Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decoder
Attackers can crash Fiber web applications by sending form data with excessively large numeric keys, causing memory exhaustion or panics.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54801?
CVE-2025-54801 is a high-severity denial of service vulnerability in gofiber fiber, published on 5 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fiber is an Express inspired web framework written in Go. In versions 2.52.8 and below, when using Fiber's Ctx.BodyParser to parse form data containing a large numeric key that represents a slice index (e.g., test.18446744073704), the application crashes due to an out-of-bounds slice allocation in the underlying schema decoder. The root cause is that the decoder attempts to allocate a slice of length idx + 1 without validating whether the index is within a safe or reasonable range. If the idx is excessively large, this leads to an integer overflow or memory exhaustion, causing a panic or crash. This is fixed in version 2.52.9.
Weakness: CWE-789
Which versions are affected by CVE-2025-54801?
3 open source packages ship an affected version, including github.com/gofiber/fiber/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gofiber/fiber/v2 Go | All versions | 2.52.9 |
github.com/gofiber/fiber/v2 Go | All versions | 2.52.9 |
github.com/gofiber/fiber/v2 Go | All versions | 2.52.9 |
Products include Gofiber Fiber.
How do I fix CVE-2025-54801?
Upgrade github.com/gofiber/fiber/v2 to 2.52.9 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-54801 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54801 exists.
Other vulnerabilities in gofiber fiber
- CVE-2024-38513 Fiber Session Middleware Token Injection Vulnerability
- CVE-2023-45128 CSRF Token Reuse Vulnerability in fiber
- CVE-2024-25124 Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials
- CVE-2025-66630 Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure
- CVE-2023-45141 CSRF Token Validation Vulnerability in fiber
Sources
Also known as GHSA-qx2q-88mx-vhg7, GO-2025-3845.