cve/2025/CVE-2025-48075.md

### [CVE-2025-48075](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48075)
![](https://img.shields.io/static/v1?label=Product&message=fiber&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.52.6%2C%20%3C%202.52.7%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-129%3A%20Improper%20Validation%20of%20Array%20Index&color=brightgreen)

### Description

Fiber is an Express-inspired web framework written in Go. Starting in version 2.52.6 and prior to version 2.52.7, `fiber.Ctx.BodyParser` can map flat data to nested slices using `key[idx]value` syntax, but when idx is negative, it causes a panic instead of returning an error stating it cannot process the data. Since this data is user-provided, this could lead to denial of service for anyone relying on this `fiber.Ctx.BodyParser`  functionality. Version 2.52.7 fixes the issue.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/found-cake/bodyparserlol