CVE-2025-66630
Predictable UUIDv4 Generation in Fiber v2 Causes Security Risk
Publication date: 2026-02-09
Last updated on: 2026-02-28
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gofiber | fiber | to 2.52.11 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-338 | The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
Can you explain this vulnerability to me?
This vulnerability exists in the Fiber web framework, which is written in Go. Before version 2.52.11, on Go versions prior to 1.24, the crypto/rand package can return an error if it fails to obtain secure randomness. However, Fiber's UUID functions do not return this error, causing the application to unknowingly use predictable, repeated, or low-entropy UUIDs. Since many Fiber middleware components rely on these UUIDs for security-critical functions like sessions, CSRF protection, rate limiting, and request ID generation, this flaw can compromise security.
How can this vulnerability impact me? :
The impact of this vulnerability is that security-critical identifiers generated by Fiber may be predictable or repeated due to low-entropy UUIDs. This can lead to potential security risks such as session hijacking, bypassing CSRF protections, ineffective rate limiting, and compromised request tracking. Essentially, attackers could exploit these predictable identifiers to impersonate users or disrupt application security mechanisms.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade the Fiber web framework to version 2.52.11 or later.
Additionally, ensure that your Go runtime version is 1.24 or later to avoid issues with the underlying crypto/rand implementation.