{"id":"CVE-2025-54801","aliases":["GHSA-qx2q-88mx-vhg7","GO-2025-3845"],"url":"https://o3.security/vulnerability/CVE-2025-54801","summary":"Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decoder","details":"Fiber is an Express inspired web framework written in Go. In versions 2.52.8 and below, when using Fiber's Ctx.BodyParser to parse form data containing a large numeric key that represents a slice index (e.g., test.18446744073704), the application crashes due to an out-of-bounds slice allocation in the underlying schema decoder. The root cause is that the decoder attempts to allocate a slice of length idx + 1 without validating whether the index is within a safe or reasonable range. If the idx is excessively large, this leads to an integer overflow or memory exhaustion, causing a panic or crash. This is fixed in version 2.52.9.","published":"2025-08-05T23:33:28.221Z","modified":"2026-08-12T03:51:10.194392350Z","cvss":null,"epss":{"score":0.00355,"percentile":0.29083,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/gofiber/fiber/v2","fixedVersion":"2.52.9"}],"fix":{"url":"https://github.com/gofiber/fiber/commit/e115c08b8f059a4a031b492aa9eef0712411853d","label":"gofiber/fiber@e115c08"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54801.json"},{"type":"ADVISORY","url":"https://github.com/gofiber/fiber/security/advisories/GHSA-qx2q-88mx-vhg7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54801"},{"type":"FIX","url":"https://github.com/gofiber/fiber/commit/e115c08b8f059a4a031b492aa9eef0712411853d"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:10.194392350Z"}}