Technical impact
Fiber is an Express‑inspired web framework written in Go. A missing validation during route registration combined with an unbounded array write during request matching creates a route parameter overflow. When a remote attacker sends an HTTP request that includes more than 30 parameters, the framework crashes, resulting in a denial of service. The flaw is categorized as CWE‑129, and based on the description, it is inferred that the vulnerability does not require privileged access, so it can be triggered simply by sending a crafted request to any public‑facing Fiber instance.
Affected Systems
The vulnerability affects Fiber v2 and v3 prior to the release of patches. Any project using Fiber v2 older than 2.52.12 or Fiber v3 older than 3.1.0 is susceptible. The runtime environment is typically web servers running the Go runtime that host the Fiber application, regardless of operating system.
Risk and Exploitability
The CVSS score is 5.5, indicating moderate severity. The EPSS score of <1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, because the overflow can be triggered remotely without authentication, the operational risk remains for publicly accessible services. An attacker may simply request a URL with an excessive number of route parameters to crash the application.
Github GHSA