What’s Vulnerable › Vulnerabilities

CVE-2025-48075: Fiber panics when fiber.Ctx.BodyParser parses invalid range index

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-05-22 · updated 2026-06-17
• Weakness: CWE-129

Description

Fiber is an Express-inspired web framework written in Go. Starting in version 2.52.6 and prior to version 2.52.7, `fiber.Ctx.BodyParser` can map flat data to nested slices using `key[idx]value` syntax, but when idx is negative, it causes a panic instead of returning an error stating it cannot process the data. Since this data is user-provided, this could lead to denial of service for anyone relying on this `fiber.Ctx.BodyParser` functionality. Version 2.52.7 fixes the issue.

Affected products

• gofiber fiber: from 2.0.0 before 2.52.7 — fixed in 2.52.7

How to fix

Upgrade to a fixed version: gofiber fiber 2.52.7. Check the vendor advisory for mitigations.

References

• https://github.com/gofiber/fiber/commit/e115c08b8f059a4a031b492aa9eef0712411853d
• https://github.com/gofiber/fiber/security/advisories/GHSA-hg3g-gphw-5hhm
• https://github.com/gofiber/fiber/security/advisories/GHSA-hg3g-gphw-5hhm

Get alerted when CVE-2025-48075 or the next vulnerability affects your stack