Executive brief
Fiber has an insecure fallback in utils.UUIDv4() / utils.UUID() on crypto/rand failure in github.com/gofiber/fiber
Affected products
- Go github.com/gofiber/fiber
- Go github.com/gofiber/fiber/v2
Junglewise Threat Intelligence
CVE-2025-66630: GO-2026-4471 - Fiber has an insecure fallback in utils.UUIDv4() / utils.UUID() on crypto/rand failure in github.com/gofiber/fiber
CVE-2025-66630 · Severity: medium · CVSS 4 · Published 2026-02-19
Technologies: github.com/gofiber/fiber (Go), github.com/gofiber/fiber/v2 (Go). Vendors: Go.
Related threats
- Gofiber Fiber HSTS header omission in helmet middleware
- Gofiber Fiber IP spoofing in BalancerForward proxy helper
- Go Fiber XSS in AutoFormat content negotiation
- GO-2026-4543 - Fiber has a Denial of Service Vulnerability via Route Parameter Overflow in github.com/gofiber/fiber
- GO-2025-3845 - Fiber Crashes in BodyParser Due to Unvalidated Large Slice Index in Decoder in github.com/gofiber/fiber