High severity7.5NVD Advisory· Published Feb 24, 2026· Updated Jun 17, 2026
CVE-2026-25899
CVE-2026-25899
Description
Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use of the fiber_flash cookie can force an unbounded allocation on any server. A crafted 10-character cookie value triggers an attempt to allocate up to 85GB of memory via unvalidated msgpack deserialization. No authentication is required. Every GoFiber v3 endpoint is affected regardless of whether the application uses flash messages. Version 3.1.0 fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/gofiber/fiber/v3Go | < 3.1.0 | 3.1.0 |
Affected products
5- ghsa-coords3 versionspkg:golang/github.com/gofiber/fiber/v3pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
< 3.1.0+ 2 more
- (no CPE)range: < 3.1.0
- (no CPE)range: < 0.0.20260226T182644-150000.1.149.1
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
5- github.com/gofiber/fiber/security/advisories/GHSA-2mr3-m5q5-wgp6nvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-2mr3-m5q5-wgp6ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-25899ghsaADVISORY
- github.com/gofiber/fiber/releases/tag/v3.1.0nvdRelease NotesWEB
- pkg.go.dev/vuln/GO-2026-4534ghsaWEB
News mentions
0No linked articles in our index yet.