GitHub Security Advisory: GHSA-m98w-cqp3-qcqr
Package: github.com/gofiber/utils/v2 (GO)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-252: Unchecked Return Value, CWE-331: Insufficient Entropy, CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Vulnerable versions: < 2.0.0-rc.3.0[PII_REDACTED]0924-6c6cf047032b
Patched in: 2.0.0-rc.4

Summary: Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values

Details:
## Summary

Critical security vulnerabilities exist in both the `UUIDv4()` and `UUID()` functions of the `github.com/gofiber/utils` package. When the system's cryptographic random number generator (`crypto/rand`) fails, both functions silently fall back to returning predictable UUID values, the zero UUID `"[PII_REDACTED]-[PII_REDACTED]"`. This compromises the security of all Fiber applications using these functions for security-critical operations on **Go versions prior to 1.24**.

**Both functions are vulnerable to the same root cause (`crypto/rand` failure):**

* `UUIDv4()`: Indirect vulnerability through `uuid.NewRandom()` → `crypto/rand.Read()` → fallback to `UUID()`
* `UUID()`: Direct vulnerability through `crypto/rand.Read(uuidSeed[:])` → silent zero UUID return

> **Note:** Go 1.24 and later panics on `crypto/rand` `Read()` failures, mitigating this vulnerability. Applications running on Go 1.24+ are not affected by the silent fallback behavior.

---

## Vulnerability Details

### Affected Functions

* **Package**: `github.com/gofiber/utils`
* **Functions**: `UUIDv4()` and `UUID()`
* **Return Type**: `string` (both functions)
* **Locations**: `common.go:93-99` (UUIDv4), `common.go:60-89` (UUID)

### Technical Description

The vulnerability occurs through two related but distinct failure paths, both ultimately caused by `crypto/rand.Read()` failures on Go < 1.24:

#### Primary Path: UUIDv4() Vulnerability

1. `UUIDv4()` calls `google/uuid.NewRandom()` which internally uses `crypto/rand.Read()`
2. If `uuid.NewRandom()` fails, `UUIDv4()` falls back to the internal `UUID()` function
3. **No error is returned to the application** - silent security failure occurs

#### Secondary Path: UUID() Vulnerability

1. `UUID()` directly calls `crypto/rand.Read(uuidSeed[:])` to seed its internal state
2. If seeding fails, `UUID()` **silently fails** and returns the zero UUID `"[PII_REDACTED]-[PII_REDACTED]"`
3. Applications receive predictable UUIDs with no indication of the security failure

---

### Code Analysis

#### UUIDv4() Vulnerability Path

```go
func UUIDv4() string {
	token, err := uuid.NewRandom()  // Uses crypto/rand.Read() internally
	if err != nil {
		return UUID()  // Dangerous fallback - no error returned to application
	}
	return token.String()
}
```

#### UUID() Vulnerability Path

```go
func UUID() string {
	uuidSetup.Do(func() {
		if _, err := rand.Read(uuidSeed[:]); err != nil {  // Direct crypto/rand.Read() call
			return  // Silent failure - no seeding, uuidCounter remains 0
		}
		uuidCounter = binary.LittleEndian.Uint64(uuidSeed[:8])
	})
	if atomic.LoadUint64(&uuidCounter) <= 0 {
		return "[PII_REDACTED]-[PII_REDACTED]"  // Zero UUID returned silently
	}
	// ... generate UUID from counter
}
```

**Root Cause:** Both vulnerabilities stem from `crypto/rand.Read()` failures, occurring through different code paths with the same dangerous silent fallback behavior.

---

## Security Impact

### Severity: CRITICAL

Th