CVE-2025-54365: fastapi guard — Exploit

Description

fastapi-guard is a security library for FastAPI that provides middleware to control IPs, log requests, detect penetration attempts and more. In version 3.0.1, the regular expression patched to mitigate the ReDoS vulnerability by limiting the length of string fails to catch inputs that exceed this limit. This type of patch fails to detect cases in which the string representing the attributes of a <script> tag exceeds 100 characters. As a result, most of the regex patterns present in version 3.0.1 can be bypassed. This is fixed in version 3.0.2.

Is your site exposed to CVE-2025-54365?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-20 Improper Input Validation

CWE-185 CWE-185

CWE-1333 CWE-1333

Affected Products

Vendor	Product	Versions
fastapi-guard	fastapi_guard	All

References

Advisories & Patches

https://github.com/rennf93/fastapi-guard/commit/0829292c322d33dc14ab00c5451c5c138148035a https://github.com/rennf93/fastapi-guard/commit/d9d50e8130b7b434cdc1b001b8cfd03a06729f7f https://github.com/rennf93/fastapi-guard/security/advisories/GHSA-rrf6-pxg8-684g https://github.com/rennf93/fastapi-guard/security/advisories/GHSA-rrf6-pxg8-684g

Exploits

https://github.com/rennf93/fastapi-guard/security/advisories/GHSA-rrf6-pxg8-684g https://github.com/rennf93/fastapi-guard/security/advisories/GHSA-rrf6-pxg8-684g

Frequently Asked Questions

What is CVE-2025-54365? +

fastapi-guard is a security library for FastAPI that provides middleware to control IPs, log requests, detect penetration attempts and more. In version 3.0.1, the regular expression patched to mitigate the ReDoS vulnerability by limiting the length of string fails to catch inputs that exceed this limit. This type of patch fails to detect cases in which the string representing the attributes of a <script> tag exceeds 100 characters. As a result, most of the regex patterns present in version 3.0.1 can be bypassed. This is fixed in version 3.0.2. It has a CVSS v3.1 base score of 7.5 (HIGH).

How severe is CVE-2025-54365? +

CVE-2025-54365 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2025-54365? +

CVE-2025-54365 affects products from fastapi-guard, specifically: fastapi_guard. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-54365? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-13826

Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is …

CVE-2024-54011

Penetration Testing engineers at Amazon have discovered a flaw where the camera system fails to properly handle data supplied in …

CVE-2026-6409

A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured …

CVE-2026-12569

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may …

CVE-2025-23202

Bible Module is a tool designed for ROBLOX developers to integrate Bible functionality into their games. The `FetchVerse` and `FetchPassage` …

CVE-2025-24501

An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request.

CVE-2025-54365