Vulnerability details

CVE-2026-25899

gofiber fiber

Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation

CVSS 3.1

7.5High

Official description

Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use of the `fiber_flash` cookie can force an unbounded allocation on any server. A crafted 10-character cookie value triggers an attempt to allocate up to 85GB of memory via unvalidated msgpack deserialization. No authentication is required. Every GoFiber v3 endpoint is affected regardless of whether the application uses flash messages. Version 3.1.0 fixes the issue.

CVSS scores

Score	Version	Source	Vector
7.5High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Affected products

Vendor	Product	Versions	Source
gofiber	fiber	>= 3.0.0, < 3.1.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/gofiber/fiber/security/advisories/GHSA-2mr3-m5q5-wgp6 x_refsource_CONFIRM
https://github.com/gofiber/fiber/releases/tag/v3.1.0 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-02-25
Last updated: 2026-02-25
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.45%

Probability of exploitation in 30 days

39.2%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-789
Memory Allocation with Excessive Size Value