Back to feed
EUVD-2026-8563 · Published Feb 24, 2026
Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability results from missing validation during route registration combined with an unbounded array write during request matching. Version 2.52.12 patches the issue in the v2 branch and 3.1.0 patches the issue in the v3 branch.
Technologies
Gofiber Fiber
Weaknesses
CWE-129
CVSS scores
- v4.05.5
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - v3.17.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
- https://github.com/gofiber/fiber/security/advisories/GHSA-mrq8-rjmw-wpq3
- https://github.com/gofiber/fiber/blob/main/path.go#L514
- https://github.com/gofiber/fiber/blob/v2/path.go#L516
- https://github.com/gofiber/fiber/pull/3962
- https://nvd.nist.gov/vuln/detail/CVE-2026-25882
- https://github.com/gofiber/fiber
Potentially impacted assets
See if this affects your attack surface
