CVE-2026-25882 Fiber has a Denial of Service Vulnerability via Route Parameter Overflow
Remote attackers can crash Fiber web applications by sending requests with excessive route parameters, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25882?
CVE-2026-25882 is a medium-severity denial of service vulnerability in gofiber fiber, published on 24 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability results from missing validation during route registration combined with an unbounded array write during request matching. Version 2.52.12 patches the issue in the v2 branch and 3.1.0 patches the issue in the v3 branch.
Weakness: CWE-129
Which versions are affected by CVE-2026-25882?
6 open source packages ship an affected version, including github.com/gofiber/fiber/v2 and github.com/gofiber/fiber/v3. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gofiber/fiber/v2 Go | All versions | 2.52.12 |
github.com/gofiber/fiber/v2 Go | All versions | 2.52.12 |
github.com/gofiber/fiber/v2 Go | All versions | 2.52.12 |
github.com/gofiber/fiber/v3 Go | All versions | 3.1.0 |
github.com/gofiber/fiber/v3 Go | All versions | 3.1.0 |
github.com/gofiber/fiber/v3 Go | All versions | 3.1.0 |
Products include Gofiber Fiber.
How do I fix CVE-2026-25882?
Upgrade github.com/gofiber/fiber/v2 to 2.52.12 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-25882 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25882 exists.
Other vulnerabilities in gofiber fiber
- CVE-2024-38513 Fiber Session Middleware Token Injection Vulnerability
- CVE-2023-45128 CSRF Token Reuse Vulnerability in fiber
- CVE-2024-25124 Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials
- CVE-2025-66630 Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure
- CVE-2025-54801 Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decoder
Sources
Also known as GHSA-mrq8-rjmw-wpq3, GO-2026-4543.