Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values
Date: 2025-12
Affected: go/github.com/gofiber/utils, go/github.com/gofiber/utils/v2
Attack vector: other
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2025-66565
CWE: CWE-252
CWE-331
CWE-338

## Summary Critical security vulnerabilities exist in both the `UUIDv4()` and `UUID()` functions of the `github.com/gofiber/utils` package. When the system's cryptographic random number generator (`crypto/rand`) fails, both functions silently fall back to returning predictable UUID values, the zero UUID `"00000000-0000-0000-0000-000000000000"`. This compromises the security of all Fiber applications using these functions for security-critical operations on **Go versions prior to 1.24**. **Both functions are vulnerable to the same root cause (`crypto/rand` failure):** * `UUIDv4()`: Indirect vulnerability through `uuid.NewRandom()` → `crypto/rand.Read()` → fallback to `UUID()` * `UUID()`: Direct vulnerability through `crypto/rand.Read(uuidSeed[:])` → silent zero UUID return > **Note:** Go 1.24 and later panics on `crypto/rand` `Read()` failures, mitigating this vulnerability. Applications running on Go 1.24+ are not affected by the silent fallback behavior. --- ## Vulnerability Details ### Affected Functions * **Package**: `github.com/gofiber/utils` * **Functions**: `UUIDv4()` and `UUID()` * **Return Type**: `string` (both functions) * **Locations**: `common.go:93-99` (UUIDv4), `common.go:60-89` (UUID) ### Technical Description The vulnerability occurs through two related but distinct failure paths, both ultimately caused by `crypto/rand.Read()` failures on Go < 1.24: #### Primary Path: UUIDv4() Vulnerability 1. `UUIDv4()` calls `google/uuid.NewRandom()` which inter


Mitigations:

Architectural layers (MAESTRO):