Fiber is an Express inspired web framework written in Go. In versions 2.52.8 and below, when using Fiber's Ctx.BodyParser to parse form data containing a large numeric key that represents a slice index (e.g., test.18446744073704), the application crashes due to an out-of-bounds slice allocation in the underlying schema decoder. The root cause is that the decoder attempts to allocate a slice of length idx + 1 without validating whether the index is within a safe or reasonable range. If the idx is excessively large, this leads to an integer overflow or memory exhaustion, causing a panic or crash. This is fixed in version 2.52.9.

Affected: Go: github.com/gofiber/fiber/v2

### Description

When using Fiber's `Ctx.BodyParser` to parse form data containing a large numeric key that represents a slice index (e.g., `test.18446744073704`), the application crashes due to an out-of-bounds slice allocation in the underlying schema decoder.

The root cause is that the decoder attempts to allocate a slice of length `idx + 1` without validating whether the index is within a safe or reasonable range. If `idx` is excessively large, this leads to an integer overflow or memory exhaustion, causing a panic or crash.

### Steps to Reproduce

Create a POST request handler that accepts `x-www-form-urlencoded` data

```go package main

import ( "fmt" "net/http"

"github.com/gofiber/fiber/v2" )

type RequestBody struct { NestedContent []*struct{} `form:"test"` }

func main() { app := fiber.New()

app.Post("/", func(c *fiber.Ctx) error { formData := RequestBody{} if err := c.BodyParser(&formData); err != nil { fmt.Println(err) return c.SendStatus(http.StatusUnprocessableEntity) } return nil })

fmt.Println(app.Listen(":3000")) }

```

Run the server and send a POST request with a large numeric key in form data, such as:

```bash curl -v -X POST localhost:3000 --data-raw 'test.18446744073704' \ -H 'Content-Type: application/x-www-form-urlencoded' ```

### Relevant Code Snippet

Within the decoder's [decode method](https://github.com/gofiber/fiber/blob/v2.52.8/internal/schema/decoder.go#L249):

```go idx := parts[0].index if v.IsNil() || v.Len…

govulncheck-vulndb-0.0.20250811T192933-1.1 on GA media