No access to your tenant or devices. Every item links to its source. What this means
Fiber is an Express-inspired web framework written in Go. Starting in version 2.52.6 and prior to version 2.52.7, `fiber.Ctx.BodyParser` can map flat data to nested slices using `key[idx]value` syntax, but when idx is negative, it causes a panic instead of returning an error stating it cannot process the data. Since this data is user-provided, this could lead to denial of service for anyone relying on this `fiber.Ctx.BodyParser` functionality. Version 2.52.7 fixes the issue.
Read the publisher's advisoryFiber is an Express-inspired web framework written in Go. Starting in version 2.52.6 and prior to version 2.52.7, `fiber.Ctx.BodyParser` can map flat data to nested slices using `key[idx]value` syntax, but when idx is negative, it causes a panic instead of returning an error stating it cannot process the data. Since this data is user-provided, this could lead to denial of service for anyone relying on this `fiber.Ctx.BodyParser` functionality. Version 2.52.7 fixes the issue.
Read the publisher's advisoryFiber is an Express-inspired web framework written in Go. Starting in version 2.52.6 and prior to version 2.52.7, `fiber.Ctx.BodyParser` can map flat data to nested slices using `key[idx]value` syntax, but when idx is negative, it causes a panic instead of returning an error stating it cannot process the data. Since this data is user-provided, this could lead to denial of service for anyone relying on this `fiber.Ctx.BodyParser` functionality. Version 2.52.7 fixes the issue.
Read the publisher's advisory### Summary When using the `fiber.Ctx.BodyParser` to parse into a struct with range values, a panic occurs when trying to parse a negative range index ### Details `fiber.Ctx.BodyParser` can map flat data to nested slices using `key[idx]value` syntax, however when idx is negative, it causes a panic instead of returning an error stating it cannot process the data. Since this data is user-provided, this could lead to denial of service for anyone relying on this `fiber.Ctx.BodyParser` functionality ### Reproducing Take a simple GoFiberV2 server which returns a JSON encoded version of the FormData ```go package main import ( "encoding/json" "fmt" "net/http" "github.com/gofiber/fiber/v2" ) type RequestBody struct { NestedContent []*struct { Value string `form:"value"` } `form:"nested-content"` } func main() { app := fiber.New() app.Post("/", func(c *fiber.Ctx) error { formData := RequestBody{} if err := c.BodyParser(&formData); err != nil { fmt.Println(err) return c.SendStatus(http.StatusUnprocessableEntity) } c.Set("Content-Type", "application/json") s, _ := json.Marshal(formData) return c.SendString(string(s)) }) fmt.Println(app.Listen(":3000")) } ``` **Correct Behaviour** Send a valid request such as: ```bash curl --location 'localhost:3000' \ --form 'nested-content[0].value="Foo"' \ --form 'nested-content[1].value="Bar"' ``` You recieve valid JSON ```json {"NestedContent":[{"Value":"Foo"},{"Value":"Bar"}]} ``` **Crashing behaviour** Send an invalid request such as: ```bash curl --location 'localhost:3000' \ --form 'nested-content[-1].value="Foo"' ``` The server panics and crashes ``` panic: reflect: slice index out of range goroutine 8 [running]: reflect.Value.Index({0x738000?, 0xc000010858?, 0x0?}, 0x738000?) /usr/lib/go-1.24/src/reflect/value.go:1418 +0x167 github.com/gofiber/fiber/v2/internal/schema.(*Decoder).decode(0xc00002c570, {0x75d420?, 0xc000010858?, 0x7ff424822108?}, {0xc00001c498, 0x17}, {0xc00014e2d0, 0x2, 0x2}, {0xc00002c710, ...}) [...] ``` ### Impact Anyone using `fiber.Ctx.BodyParser` can/will have their servers crashed when an invalid payload is sent
Read the publisher's advisoryFiber panics when fiber.Ctx.BodyParser parses invalid range index in github.com/gofiber/fiber
Read the publisher's advisoryVendor product
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "gofiber",
"product": "fiber",
"versions": [
{
"version": ">= 2.52.6, < 2.52.7",
"status": "affected"
}
]
}Original source record · Cite this exact observation · Complete original publisher JSON
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
datePublished: May 22, 2025, 5:25:18 PM
dateUpdated: May 22, 2025, 5:59:02 PM
openSUSE-SU-2025:15179-1: govulncheck-vulndb-0.0.20250527T204717-1.1 on GA media
CVE-2025-4123 · CVE-2025-48075 · CVE-2025-48371 · CVE-2025-48374
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Analyzed
Weakness classifications: CWE-129
published: 2025-05-22T18:15:43.310
lastModified: 2026-06-17T09:29:06.793
The original JSON retains the logical configuration operators, exclusions and version bounds.
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON
Go
SEMVER · introduced 2.52.6 → fixed 2.52.7
Original source record · Cite this exact observation · Complete original publisher JSON
Go
SEMVER · introduced 0
Go
SEMVER · introduced 2.52.6 → fixed 2.52.7
Original source record · Cite this exact observation · Complete original publisher JSON