CVE-2025-66630 is a critical flaw (CVSS 9.4) in the Go web framework Fiber. Before 2.52.11, on Go versions prior to 1.24, Fiber v2 UUID functions can return predictable values if secure randomness cannot be obtained. Upgrade Fiber to 2.52.11 or later, and Go to 1.24 or later.
What's affected
- gofiber/fiber v2 before 2.52.11.
- Applies on Go versions prior to 1.24, where crypto/rand can return an error that Fiber v2 does not surface.
- Fixed version: Fiber 2.52.11.
How to check if you're exposed
Check the Fiber version in your module:
go list -m github.com/gofiber/fiber/v2
Check the Go toolchain that builds and runs the service:
go version
You are in scope if Fiber is below 2.52.11 and the build uses Go older than 1.24. Next, find what depends on the UUID helper. Fiber v2 session, CSRF, rate limiting and request ID middleware default to utils.UUIDv4(), so any of those in use deserve a look.
You can also paste a manifest or lockfile into the free in-browser dependency scan at gold.safeguard.sh/scan. It lists known CVEs for the versions it finds and runs in your browser.
What to do now
- Run the module check in every Go service and note which use Fiber v2.
- Upgrade to Fiber 2.52.11 or later and run your tests.
- Build with Go 1.24 or later where you can, since the advisory describes the problem on earlier Go versions.
- List which middleware you use that generates identifiers: sessions, CSRF tokens, rate limiting and request IDs.
- Consider invalidating long lived sessions and tokens created before the upgrade if the services ran on Go before 1.24 in an environment that could be short of entropy.
- Rebuild and redeploy images so the updated dependency is what runs.
Why it matters
The weakness is CWE-338, use of a cryptographically weak pseudo random number generator. In this case the generator is the system one, which is sound, but the failure path matters. When secure randomness cannot be obtained, the Fiber v2 UUID functions have no error return, so application code carries on with a value that may be repeated or low in entropy.
That is a quiet failure. Session identifiers and CSRF tokens only protect you if nobody can guess them. If they are predictable, the controls built on top of them stop doing their job without any visible error.
The advisory ties the issue to Go before 1.24 and to cases where the operating system cannot supply randomness. Many deployments will never hit it, which is why reachability matters here: knowing that your service uses the helper, and on which Go version, tells you how urgent it is. The record does not list this CVE as exploited in the wild.
Think about how your services use identifiers. A random identifier is only a secret if its source is sound. When code asks for a UUID it usually assumes success, and a library that hides an error from the caller makes that assumption silent. Newer Go versions changed the behaviour of the random source so that it no longer returns an error in the same way, which is why the advisory points at Go before 1.24.
If your services run in minimal containers, on unusual hardware, or very early in boot, the supply of randomness is something to check. For most cloud workloads it is plentiful.
After upgrading, a good test is to read the middleware list in your app and write down which values are meant to be unguessable. Session ids and CSRF tokens are the main ones. If any long lived values were generated under the risky conditions, rotating them costs little.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is upgrading Go enough for CVE-2025-66630?
The advisory describes the issue on Go before 1.24 and names Fiber 2.52.11 as the fixed release. Upgrade Fiber, and use a newer Go as well.
Sources
- https://github.com/gofiber/fiber/security/advisories/GHSA-68rr-p4fp-j59v
- https://github.com/gofiber/fiber/releases/tag/v2.52.11
Last reviewed: 19 October 2026.
