CVE-2026-25882: Fiber has a Denial of Service Vulnerability via Route Parameter Overflow
Vulnerability summary
CVE-2026-25882 is a high (CVSS 7.5) Improper Validation of Array Index vulnerability in gofiber fiber. EPSS estimates a 0.90% chance of exploitation in the next 30 days, higher than 59.3% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 3Timeline
- 24-02-2026PublishedVulnerability first disclosed.
- 24-02-2026Last modifiedVulnerability information updated.
Description
Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability results from missing validation during route registration combined with an unbounded array write during request matching. Version 2.52.12 patches the issue in the v2 branch and 3.1.0 patches the issue in the v3 branch.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · WolfiEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:PDiffers
- OSV · GoEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:PDiffers
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:PDiffers
- NVDNIST5.5MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.90%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
Increase +0.32 pp
From 0.59% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundFiber
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard2 products
- gatus< 5.35.0-r1
- gatus-fips< 5.35.0-r1
Github.com/gofiber/fiber2 products
- v2< 2.52.12
- v3< 3.1.0
Gofiber1 product
- fiber≥ 2.0.0, < 2.52.12 | ≥ 3.0.0, < 3.1.0
Wolfi1 product
- gatus< 5.35.0-r1
4 vendors · 6 products
References
8 links- github.com/gofiber/fiber/security/advisories/GHSA-mrq8-rjmw-wpq3X Refsource CONFIRMAdvisoryWEBExploitVendor Advisory
- github.com/gofiber/fiberPACKAGE