EUVD-2026-240966

fkie_cve-2025-48075

Fiber is an Express-inspired web framework written in Go. Starting in version 2.52.6 and prior to version 2.52.7, `fiber.Ctx.BodyParser` can map flat data to nested slices using `key[idx]value` syntax, but when idx is negative, it causes a panic instead of returning an error stating it cannot process the data. Since this data is user-provided, this could lead to denial of service for anyone relying on this `fiber.Ctx.BodyParser` functionality. Version 2.52.7 fixes the issue.

GHSA-hg3g-gphw-5hhm — Fiber panics when fiber.Ctx.BodyParser parses invalid range index

Affected: Go: github.com/gofiber/fiber/v2

### Summary When using the `fiber.Ctx.BodyParser` to parse into a struct with range values, a panic occurs when trying to parse a negative range index

### Details `fiber.Ctx.BodyParser` can map flat data to nested slices using `key[idx]value` syntax, however when idx is negative, it causes a panic instead of returning an error stating it cannot process the data.

Since this data is user-provided, this could lead to denial of service for anyone relying on this `fiber.Ctx.BodyParser` functionality

### Reproducing Take a simple GoFiberV2 server which returns a JSON encoded version of the FormData ```go package main

import ( "encoding/json" "fmt" "net/http"

"github.com/gofiber/fiber/v2" )

type RequestBody struct { NestedContent []*struct { Value string `form:"value"` } `form:"nested-content"` }

func main() { app := fiber.New()

app.Post("/", func(c *fiber.Ctx) error { formData := RequestBody{} if err := c.BodyParser(&formData); err != nil { fmt.Println(err) return c.SendStatus(http.StatusUnprocessableEntity) } c.Set("Content-Type", "application/json") s, _ := json.Marshal(formData) return c.SendString(string(s)) })

fmt.Println(app.Listen(":3000")) }

```

**Correct Behaviour** Send a valid request such as: ```bash curl --location 'localhost:3000' \ --form 'nested-content[0].value="Foo"' \ --form 'nested-content[1].value="Bar"' ``` You recieve valid JSON ```json {"NestedContent":[{"Value":"Foo"},{"…

openSUSE-SU-2025:15179-1 — govulncheck-vulndb-0.0.20250527T204717-1.1 on GA media

govulncheck-vulndb-0.0.20250527T204717-1.1 on GA media

Most recent entries from all

EUVD-2026-240966

fkie_cve-2025-48075

GHSA-hg3g-gphw-5hhm — Fiber panics when fiber.Ctx.BodyParser parses invalid range index

openSUSE-SU-2025:15179-1 — govulncheck-vulndb-0.0.20250527T204717-1.1 on GA media