CVE-2025-48075: Fiber panics when fiber.Ctx.BodyParser parses invalid range index

May 22, 2025 (updated October 31, 2025)

When using the fiber.Ctx.BodyParser to parse into a struct with range values, a panic occurs when trying to parse a negative range index

References

github.com/advisories/GHSA-hg3g-gphw-5hhm
github.com/gofiber/fiber
github.com/gofiber/fiber/commit/e115c08b8f059a4a031b492aa9eef0712411853d
github.com/gofiber/fiber/security/advisories/GHSA-hg3g-gphw-5hhm
nvd.nist.gov/vuln/detail/CVE-2025-48075
pkg.go.dev/vuln/GO-2025-3706

Code Behaviors & Features

Detect and mitigate CVE-2025-48075 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →