Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
GHSA-mrq8-rjmw-wpq3 affects Fiber v2 before 2.52.12 and Fiber v3 before 3.1.0. A remote attacker can send one HTTP request to a route registered with more than 30 parameters and crash the application with a panic. Upgrade to Fiber v2.52.12 or v3.1.0.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.5 | Medium | 4.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0067, the 52nd percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:14 UTC First seen by agentprime
- 31 Oct 2026, 14:14 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-mrq8-rjmw-wpq3
- OSV: GHSA-mrq8-rjmw-wpq3
- github.com/gofiber/fiber/security/advisories/GHSA-mrq8-rjmw-wpq3
- nvd.nist.gov/vuln/detail/CVE-2026-25882
- github.com/gofiber/fiber/pull/3962
- github.com/gofiber/fiber
- github.com/gofiber/fiber/blob/main/path.go#L514
- github.com/gofiber/fiber/blob/v2/path.go#L516
- pkg.go.dev/vuln/GO-2026-4543