Improper Validation of Array Index Affecting github.com/gofiber/fiber/internal/schema package, versions >=2.52.6 <2.52.7>=3.0.0-beta.2 <3.0.0-beta.4
Threat Intelligence
Exploit Maturity
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Proof of Concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMGOFIBERFIBERINTERNALSCHEMA-10231764
- published23 May 2025
- disclosed22 May 2025
- creditBatleram
Introduced: 22 May 2025
NewCVE-2025-48075 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade github.com/gofiber/fiber/internal/schema to version 2.52.7, 3.0.0-beta.4 or higher.
Overview
Affected versions of this package are vulnerable to Improper Validation of Array Index through the fiber.Ctx.BodyParser method that panics when trying to parse a negative range index. An attacker can cause the server to crash by sending a specially crafted payload with a negative index for array elements.
PoC
curl --location 'localhost:3000' \
--form 'nested-content[-1].value="Foo"'