CVE-2025-66565 Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values
Fiber Utils silently returns predictable UUIDs when cryptographic random generation fails, compromising security-critical operations in Fiber applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-66565?
CVE-2025-66565 is a critical vulnerability in gofiber utils, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values, including the zero UUID "00000000-0000-0000-0000-000000000000". The vulnerability occurs through two related but distinct failure paths, both ultimately caused by crypto/rand.Read() failures, compromising the security of all Fiber applications using these functions for security-critical operations. This issue is fixed in version 2.0.0-rc.4.
Which versions are affected by CVE-2025-66565?
6 open source packages ship an affected version, including github.com/gofiber/utils and github.com/gofiber/utils/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gofiber/utils Go | All versions | 1.2.0 |
github.com/gofiber/utils Go | All versions | 1.2.0 |
github.com/gofiber/utils Go | All versions | 1.2.0 |
github.com/gofiber/utils/v2 Go | All versions | 2.0.0-rc.4 |
github.com/gofiber/utils/v2 Go | All versions | 2.0.0-rc.4 |
github.com/gofiber/utils/v2 Go | All versions | 2.0.0-rc.4 |
Products include Gofiber Utils.
How do I fix CVE-2025-66565?
Upgrade github.com/gofiber/utils to 1.2.0 or later.
Is CVE-2025-66565 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66565 exists.
Sources
Also known as GHSA-m98w-cqp3-qcqr, GO-2025-4208.