---
title: "Security digest: December 8, 2025"
url: https://erroneo.us/security/2025-12-08/
description: "December 8, 2025 vulnerability digest: 2 CISA KEV additions (Array Networks , D-Link); 6 critical advisories (RubyGems, npm, Go). What to patch and who can…"
type: security-digest-day
section: "Security Digest"
date_published: 2025-12-08
date_modified: 2025-12-08
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: December 8, 2025

2 known exploited (cisa kev) additions and 6 critical advisories.

## Take stock

- Do you run any of these? Array Networks ArrayOS AG, D-Link Routers. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-12-29.
- RubyGems: 2 critical advisories ( ruby-saml ). Check with bundle audit check --update .
- npm: 2 critical advisories ( n8n , @vitejs/plugin-rsc ). Check with npm audit (or: npm ls <package>) .
- Go: 2 critical advisories ( github.com/gofiber/utils/v2 , github.com/gofiber/utils , github.com/zitadel/zitadel , github.com/zitadel/zitadel/v2 ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2025-66644](https://erroneo.us/security/cve/CVE-2025-66644/index.md) Array Networks  ArrayOS AG: Array Networks ArrayOS AG OS Command Injection Vulnerability (CISA due 2025-12-29)
- [CVE-2022-37055](https://erroneo.us/security/cve/CVE-2022-37055/index.md) D-Link Routers: D-Link Routers Buffer Overflow Vulnerability (CISA due 2025-12-29)

## Critical advisories

- [CVE-2025-66568](https://erroneo.us/security/cve/CVE-2025-66568/index.md) Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation — RubyGems ruby-saml < 1.18.0 → 1.18.0
- [CVE-2025-65964](https://erroneo.us/security/cve/CVE-2025-65964/index.md) n8n vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook — npm n8n >= 0.123.1, < 1.119.2 → 1.119.2
- [CVE-2025-66565](https://erroneo.us/security/cve/CVE-2025-66565/index.md) Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values — Go github.com/gofiber/utils/v2 < 2.0.0-rc.3.0.20251205210924-6c6cf047032b → 2.0.0-rc.4; Go github.com/gofiber/utils <= 1.1.0 → 1.2.0
- [CVE-2025-67489](https://erroneo.us/security/cve/CVE-2025-67489/index.md) @vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server — npm @vitejs/plugin-rsc <= 0.5.5 → 0.5.6
- [CVE-2025-66567](https://erroneo.us/security/cve/CVE-2025-66567/index.md) Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential) — RubyGems ruby-saml < 1.18.0 → 1.18.0
- [CVE-2025-67494](https://erroneo.us/security/cve/CVE-2025-67494/index.md) ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login — Go github.com/zitadel/zitadel < 1.80.0-v2.20.0.20251208091519-4c879b47334e → 1.80.0-v2.20.0.20251208091519-4c879b47334e; Go github.com/zitadel/zitadel >= 1.83.4, <= 1.87.5 → no fix; Go github.com/zitadel/zitadel >= 4.0.0-rc.1, < 4.7.1 → 4.7.1

---
Source page: https://erroneo.us/security/2025-12-08/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt