CVE-2025-66565 is a critical (CVSS 9.8) flaw in Fiber Utils. If the system random number generator fails, the UUID and UUIDv4 functions silently return predictable values, including the zero UUID. The record says 2.0.0-rc.4 fixes it. The advisory says Go 1.24 or later is not affected.
What's affected
- Module: github.com/gofiber/utils (v1) and github.com/gofiber/utils/v2.
- Affected per the record: 2.0.0-rc.3 and below. Fixed per the record: 2.0.0-rc.4.
- Affected per the advisory: github.com/gofiber/utils up to 1.1.0 and github.com/gofiber/utils/v2 up to v2.0.0-rc.3, with no patched version listed on the page we read.
- Functions: UUIDv4 and UUID.
- Go version: the advisory says Go 1.24 and later panics when the random read fails, which removes the silent fallback, so applications built with Go 1.24 or newer are not affected by this behavior.
Sources differ on the fix. The record names 2.0.0-rc.4. The advisory shows no patched version and gives a workaround. Check the module releases to confirm.
How to check if you're exposed
Find the module and the Go toolchain version.
go list -m all | grep gofiber/utils
go version
go version -m ./your-binary | head
If you use gofiber/utils and build with Go older than 1.24, look for calls to utils.UUID or utils.UUIDv4 used for session IDs, tokens, request IDs with security meaning, or any value that must be unguessable.
What to do now
- Build with Go 1.24 or later, which the advisory says removes the silent fallback behavior.
- Upgrade gofiber/utils to the fixed release, which the record names as 2.0.0-rc.4, after confirming in the module changelog.
- As the advisory suggests, replace utils.UUIDv4() with uuid.New() from the google/uuid package where unpredictability matters.
- Audit places where these UUIDs are used as secrets, such as session identifiers or reset tokens, and use a dedicated token generator.
- Scan your Go modules for other pinned versions. Paste your manifests into the free in-browser scan at gold.safeguard.sh/scan to see which of your dependencies carry this CVE, and use reachability analysis to separate the services that actually call the affected code from the ones that only list the package.
Why it matters
The weakness classes are CWE-252, CWE-331, CWE-338: an unchecked return value, insufficient entropy and a weak pseudo random number generator. The code asks the operating system for random bytes, and when that call fails, it carries on as if nothing happened and returns a value that looks like a normal UUID. The caller never learns that the value is fixed or guessable.
A random source failing is rare on a healthy host, so exposure depends on unusual conditions, which is partly why the real risk sits below the headline score. Still, security code should fail loudly. A zero UUID used as a session ID means every session collides. The record does not list exploitation in the wild, and the CVE is not on CISA KEV.
Quick check
Does this affect me if I build with Go 1.24 or later?
The advisory says no. Go 1.24 and later panics when the random read fails, so the silent fallback does not occur.
What is the simplest mitigation?
Use uuid.New() from google/uuid for security sensitive identifiers, as the advisory suggests, and upgrade the module.
Sources
Last reviewed: 18 October 2026.
