Loading story…
Fiber v2 disclosed a high-severity weakness in its UUID generation helpers (utils.UUIDv4() / utils.UUID()) tracked as CVE-2025-66630 (CVSS v4.0 9.2, CWE-338). On Go versions prior to 1.24, crypto/rand can return an error when secure randomness is unavailable; Fiber’s UUID functions did not propagate that error, allowing applications and middleware to unknowingly proceed with predictable, repeated, or low-entropy identifiers. Reporting indicates Fiber could silently fall back to a “zero UUID” (00000000-0000-0000-0000-000000000000) in this failure mode, creating security-critical token predictability without developer visibility.
The impact spans common middleware defaults that rely on these UUIDs, including session identifiers, CSRF tokens, request IDs, and other security-sensitive values, enabling scenarios such as session hijacking, CSRF protection bypass, and potential service disruption/DoS conditions when identifiers collapse to a constant value. The issue affects Fiber v2 versions before 2.52.11 when running on Go <1.24; Fiber 2.52.11 remediates the problem, and newer Go versions change the underlying behavior around randomness failures (e.g., blocking/panicking rather than returning an error), reducing exposure compared to older runtimes.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Public reporting described how the flaw could lead to session hijacking, CSRF bypass, unauthorized access, and denial-of-service in environments where secure randomness is unavailable or misconfigured. The disclosure also clarified that Go 1.24+ handles randomness failures differently, reducing exposure on newer Go versions.
The issue was remediated in Fiber version 2.52.11, which addressed the insecure handling of crypto/rand failures in UUID generation. The fix removed the vulnerable behavior affecting earlier Fiber v2 releases in impacted environments.
A vulnerability existed in Fiber v2 in which utils.UUIDv4() / utils.UUID() could silently produce predictable or all-zero UUIDs when crypto/rand failed on Go 1.23 or earlier. This exposed applications using those UUIDs for sessions, CSRF tokens, and other security-sensitive identifiers to risks such as session hijacking, token guessing, and collisions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **`CVE-2026-41907`** was disclosed in the widely used `uuid` npm package, affecting versions prior to **`14.0.0`**. The flaw stems from missing bounds checks in the `v3`, `v5`, and `v6` functions when callers supply their own output buffer, allowing out-of-range writes when a buffer is too small or an offset is too large. The issue can cause silent partial writes into caller-provided buffers and is mapped to **`CWE-787`** and **`CWE-823`**; the disclosure is also referenced in GitHub advisory **`GHSA-w5hq-g745-h8pq`**. Maintainers fixed the issue in **`uuid 14.0.0`**, with backported patches released in **`13.0.1`**, **`12.0.1`**, and **`11.1.1`** for legacy deployments. Organizations that cannot upgrade immediately were advised to add explicit bounds validation before invoking the affected functions, ensuring `offset + 16` does not exceed the destination buffer length, and to use static analysis tools such as **Semgrep** or **ESLint** to identify code paths where `v3`, `v5`, or `v6` are called with caller-controlled `Buffer` or `Uint8Array` targets.
Jun 29, 2026
Two high-severity vulnerabilities have been disclosed in Tenda router firmware, affecting **FH451 `1.0.0.9`** and **FH1201 `1.2.0.14(408)`**. The flaws, tracked as **`CVE-2026-4535`** and **`CVE-2026-5045`**, are stack-based buffer overflows in the `WrlclientSet` function exposed through the `/goform/WrlclientSet` endpoint. In both cases, an attacker can trigger the issue by manipulating the `GO` argument, creating a remotely reachable attack path against the devices' web management interface. Both CVEs are classified under **`CWE-119`** and **`CWE-121`**, and published scoring indicates high impact to **confidentiality, integrity, and availability**, with some vectors rating the flaws at critical severity. Public exploit information is already available for both issues, raising the risk of real-world exploitation against unpatched internet-exposed routers and embedded deployments using the affected firmware.
Jun 29, 2026
The Go Project disclosed **CVE-2025-61726**, a denial-of-service flaw in the standard library's `net/url` handling that can be triggered through `net/http.Request.ParseForm`. The bug stems from the lack of a limit on query parameter counts, allowing attackers to submit URL-encoded forms with many unique parameters and drive excessive memory consumption. The issue affects Go releases before **1.24.12** and **1.25.x before 1.25.6**, and is tracked in Go issue `#77101` and Go advisory **GO-2026-4341**. Red Hat subsequently shipped **Important** security updates for multiple products bundling vulnerable Go components, most notably **grafana-pcp** across RHEL 8, RHEL 9, and RHEL 10 channels, as well as **golang-github-openprinting-ipp-usb** on RHEL 10. Several advisories bundled fixes for related Go flaws, including **CVE-2025-61729** in `crypto/x509` and **CVE-2025-68121` in `crypto/tls`, with updated packages released for `x86_64`, `aarch64`, `ppc64le`, and `s390x` architectures across standard, SAP, AUS, EUS, and Extended Life Cycle offerings.
Aug 20, 2026