CVE-2026-25899: GoFiber Package Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation
Summary
CVE-2026-25899: Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation. Affects github.com/gofiber/fiber/v3 versions < 3.1.0. Fixed in 3.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
GoFiber is a web framework for Go that is designed to be fast and efficient, providing a robust set of features for building web applications. It supports middleware, routing, and various utilities to enhance the development experience. However, the framework has a critical vulnerability related to the handling of flash cookies, which can lead to severe memory allocation issues.
Vulnerability Detail
The vulnerability arises from the use of the 'fiber_flash' cookie, which can be exploited to trigger unbounded memory allocation on the server. An attacker can craft a 10-character cookie value that forces the application to attempt to allocate up to 85GB of memory through unvalidated msgpack deserialization. This issue affects all GoFiber v3 endpoints, regardless of whether flash messages are utilized. The lack of size or content validation during the deserialization process allows attackers to manipulate the memory allocation, leading to a Denial of Service (DoS) condition.
How To Fix
Latest published version: v3.6.1 as of 22 Oct 2026
go get github.com/gofiber/fiber/v3@v3.6.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.0
This is the first release that contains the fix.
go get github.com/gofiber/fiber/v3@v3.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation for the 'fiber_flash' cookie to restrict its size and content before processing it. For example, you can check the length of the cookie value and reject any that exceed a certain threshold.
Conclusion
The GoFiber framework has a critical vulnerability that can lead to Denial of Service through unbounded memory allocation caused by improperly handled flash cookies. It is essential for developers using this framework to update to the patched version and implement necessary input validation to mitigate the risk.
See every vulnerability recorded for github.com/gofiber/fiber/v3 →
FAQ
The vulnerability allows for unbounded memory allocation via crafted flash cookies, leading to potential Denial of Service.
All versions of GoFiber v3.0.0 and earlier are affected by this vulnerability.
No, the vulnerability can be exploited without any authentication.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. With Vulert, you can check if your application is affected by this vulnerability without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gofiber/fiber/v3.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
