N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-66565

CVE-2025-66565: Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values

Summary

Critical security vulnerabilities exist in both the UUIDv4() and UUID() functions of the github.com/gofiber/utils package. When the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values, including the zero UUID "00000000-0000-0000-0000-000000000000". This compromises the security of all Fiber applications using these functions for security-critical operations.

Both functions are vulnerable to the same root cause (crypto/rand failure):

UUIDv4(): Indirect vulnerability through uuid.NewRandom() → crypto/rand.Read() → fallback to UUID()
UUID(): Direct vulnerability through crypto/rand.Read(uuidSeed[:]) → silent zero UUID return

Vulnerability Details

Affected Functions

Package: github.com/gofiber/utils
Functions: UUIDv4() and UUID()
Return Type: string (both functions)
Locations: common.go:93-99 (UUIDv4), common.go:60-89 (UUID)

Technical Description

The vulnerability occurs through two related but distinct failure paths, both ultimately caused by crypto/rand.Read() failures:

Primary Path: UUIDv4() Vulnerability

UUIDv4() calls google/uuid.NewRandom() which internally uses crypto/rand.Read()
If uuid.NewRandom() fails due to entropy exhaustion, UUIDv4() falls back to the internal UUID() function

Miggo Vulnerability Database

→

CVE-2025-66565

CVE-2025-66565:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/gofiber/utils/v2	go	< 2.0.0-rc.3.0.20251205210924-6c6cf047032b	2.0.0-rc.4
github.com/gofiber/utils	go	<= 1.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the commit 6c6cf047032b clearly shows the vulnerabilities in UUID() and UUIDv4() within common.go. The root cause is the silent failure of the random number generation process. In UUID(), if crypto/rand.Read fails, the function would proceed without a proper seed, eventually returning a hardcoded zero UUID. In UUIDv4(), if uuid.NewRandom() (which uses crypto/rand) fails, it would fall back to the insecure UUID() function instead of propagating the error. This behavior means that under certain conditions (like entropy exhaustion or misconfigured environments), functions that are supposed to generate secure, random identifiers would instead produce predictable, insecure values. The patch rectifies this by replacing the silent failures and insecure fallbacks with panic, ensuring the application fails fast and securely in case of cryptographic failures.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-66565: Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values

Summary

Vulnerability Details

Affected Functions

Technical Description

Primary Path: UUIDv4() Vulnerability

CVE-2025-66565:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

N/A

N/A

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Technical Details

CVE-2025-66565: Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values

Summary

Vulnerability Details

Affected Functions

Technical Description

Primary Path: UUIDv4() Vulnerability

Secondary Path: UUID() Vulnerability

Code Analysis

UUIDv4() Vulnerability Path

UUID() Vulnerability Path

Security Impact

Severity: CRITICAL

Attack Scenario

Real-World Impact

Proof of Concept

Affected Versions

Mitigation

Immediate Workaround

Recommended Fix

Detection

Contact

Classification

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI