EUVD-2026-262941

fkie_cve-2025-66565

Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values, including the zero UUID "00000000-0000-0000-0000-000000000000". The vulnerability occurs through two related but distinct failure paths, both ultimately caused by crypto/rand.Read() failures, compromising the security of all Fiber applications using these functions for security-critical operations. This issue is fixed in version 2.0.0-rc.4.

GHSA-m98w-cqp3-qcqr — Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values

Affected: Go: github.com/gofiber/utils/v2, Go: github.com/gofiber/utils

## Summary

Critical security vulnerabilities exist in both the `UUIDv4()` and `UUID()` functions of the `github.com/gofiber/utils` package. When the system's cryptographic random number generator (`crypto/rand`) fails, both functions silently fall back to returning predictable UUID values, the zero UUID `"00000000-0000-0000-0000-000000000000"`. This compromises the security of all Fiber applications using these functions for security-critical operations on **Go versions prior to 1.24**.

**Both functions are vulnerable to the same root cause (`crypto/rand` failure):**

* `UUIDv4()`: Indirect vulnerability through `uuid.NewRandom()` → `crypto/rand.Read()` → fallback to `UUID()` * `UUID()`: Direct vulnerability through `crypto/rand.Read(uuidSeed[:])` → silent zero UUID return

> **Note:** Go 1.24 and later panics on `crypto/rand` `Read()` failures, mitigating this vulnerability. Applications running on Go 1.24+ are not affected by the silent fallback behavior.

---

## Vulnerability Details

### Affected Functions

* **Package**: `github.com/gofiber/utils` * **Functions**: `UUIDv4()` and `UUID()` * **Return Type**: `string` (both functions) * **Locations**: `common.go:93-99` (UUIDv4), `common.go:60-89` (UUID)

### Technical Description

The vulnerability occurs through two related but distinct failure paths, both ultimately caused by `crypto/rand.Read()` failures on Go < 1.24:

#### Primary Path: UUIDv4() Vulnerability

1. `UUIDv4()` calls `google/uuid.NewRandom()` which inte…

Most recent entries from all

EUVD-2026-262941

fkie_cve-2025-66565

GHSA-m98w-cqp3-qcqr — Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values