CVE-2026-25899
published 2026-02-24CVE-2026-25899: Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use of the `fiber_flash` cookie can force an…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.40%
31.4th percentile
Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use of the `fiber_flash` cookie can force an unbounded allocation on any server. A crafted 10-character cookie value triggers an attempt to allocate up to 85GB of memory via unvalidated msgpack deserialization. No authentication is required. Every GoFiber v3 endpoint is affected regardless of whether the application uses flash messages. Version 3.1.0 fixes the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | gofiber_fiber_v3 | >= 0 < 3.1.0 | 3.1.0 |
| gofiber | fiber | — | — |
| gofiber | fiber | >= 3.0.0 < 3.1.0 | 3.1.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation in github.com/gofiber/fiber/v3
osv·2026-02-26
CVE-2026-25899 Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation in github.com/gofiber/fiber/v3
Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation in github.com/gofiber/fiber/v3
Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation in github.com/gofiber/fiber/v3
GHSA
Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation
ghsa·2026-02-24
CVE-2026-25899 [HIGH] CWE-770 Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation
Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation
### Summary
The use of the `fiber_flash` cookie can force an unbounded allocation on any server. A crafted 10-character cookie value triggers an attempt to allocate up to 85GB of memory via unvalidated msgpack deserialization. No authentication is required. Every GoFiber v3 endpoint is affected regardless of whether the application uses flash messages.
### Details
Regardless of configuration, the flash cookie is checked:
```go
func (app *App) requestHandler(rctx *fasthttp.RequestCtx) {
// Acquire context from the pool
ctx := app.AcquireCtx(rctx)
defer app.ReleaseCtx(ctx)
// Optional: Check flash messages
rawHeaders := d.Request().Header.RawHeaders()
if len(rawHeaders) > 0 && bytes.Contains(rawHeaders, flashC
OSV
Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation
osv·2026-02-24
CVE-2026-25899 [HIGH] Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation
Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation
### Summary
The use of the `fiber_flash` cookie can force an unbounded allocation on any server. A crafted 10-character cookie value triggers an attempt to allocate up to 85GB of memory via unvalidated msgpack deserialization. No authentication is required. Every GoFiber v3 endpoint is affected regardless of whether the application uses flash messages.
### Details
Regardless of configuration, the flash cookie is checked:
```go
func (app *App) requestHandler(rctx *fasthttp.RequestCtx) {
// Acquire context from the pool
ctx := app.AcquireCtx(rctx)
defer app.ReleaseCtx(ctx)
// Optional: Check flash messages
rawHeaders := d.Request().Header.RawHeaders()
if len(rawHeaders) > 0 && bytes.Contains(rawHeaders, flashC
No detection rules found.
No public exploits indexed.
2026-02-24
Published