{"id":"CVE-2026-119285","aliases":["EUVD-2026-113402","GHSA-g5jq-qmqr-qrwf","GO-2026-6896","UBUNTU-CVE-2026-119285"],"status":"published","title":"Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads","description":"Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00129,"percentile":0.02546,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-346","CWE-942"],"published":"2026-10-29T21:36:02Z","modified":"2026-11-05T23:25:41Z","fixes":[{"ecosystem":"Go","package":"github.com/gofiber/fiber/v2","fixed_in":["2.52.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/gofiber/fiber/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.52.1"},{"last_affected":"2.52.2"},{"fixed":"2.52.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/gofiber/fiber/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.52.1"},{"fixed":"2.52.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/gofiber/fiber/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.52.1"},{"fixed":"2.52.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-gofiber-fiber","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.0-1","3.4.0-1","3.5.0-1","3.5.0-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-gofiber-fiber-v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.52.13-2","2.52.13-3"]}],"products":[{"vendor":"gofiber","product":"fiber"}],"references":[{"url":"https://github.com/gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf","tags":["x_refsource_CONFIRM","exploit","advisory","web","report"]},{"url":"https://github.com/gofiber/fiber/pull/2915","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/gofiber/fiber/commit/1aac6f618b6bd3e159d2449acb4232a2170b976b","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/gofiber/fiber/releases/tag/v2.52.3","tags":["x_refsource_MISC","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119285","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g5jq-qmqr-qrwf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119285.json","tags":["advisory"]},{"url":"https://github.com/gofiber/fiber","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-119285","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-119285","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-119285","title":"Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads","description":"Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3.","status":"published","published":"2026-10-29T21:36:02.199Z","modified":"2026-11-04T01:55:09.92Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-346","CWE-942"],"updated_at":"2026-11-04T02:49:29.029968Z"}],"euvd":[{"id":"EUVD-2026-113402","description":"Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3.","status":"published","published":"2026-10-29T21:36:02Z","modified":"2026-11-04T01:55:09Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-04T03:57:29.097782Z"}],"ghsa":[{"id":"GHSA-g5jq-qmqr-qrwf","title":"Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads","description":"### Summary\n\nIn v2.52.1 and v2.52.2 the CORS middleware matched a wildcard origin such as `https://*.example.com` by suffix only, without a dot boundary and without comparing the scheme. Any origin whose host ends with the base domain, for example `https://evil-example.com` or `http://notexample.com`, was reflected in `Access-Control-Allow-Origin`, together with `Access-Control-Allow-Credentials: true` when `AllowCredentials` is enabled.\n\nv2.52.3 replaced the matcher (#2915) and is not affected. The report was filed against v2.52.15, where the dot boundary holds; see \"Other versions\" below.\n\n### Details\n\nv2.52.1 introduced `validateDomain` in `middleware/cors/utils.go` (f0cd3b44, part of the fix for GHSA-fmg4-x8pw-hjhg). It strips scheme and port from both sides and then checks only the suffix, with `trimmedPattern = \"example.com\"`, so the character before the suffix is never checked:\n\n```go\nif strings.HasPrefix(normalizedPattern, \"*.\") {\n\ttrimmedPattern := normalizedPattern[2:]\n\tif strings.HasSuffix(normalizedDomain, trimmedPattern) {\n\t\tif normalizedDomain != trimmedPattern {\n\t\t\tif strings.TrimSuffix(normalizedDomain, trimmedPattern) != \"\" {\n\t\t\t\treturn true\n\t\t\t}\n\t\t}\n\t}\n}\n```\n\nv2.52.3 (1aac6f61, #2915) replaced it with a scheme-aware prefix/suffix split that keeps the leading dot in the suffix (`.example.com`).\n\n### Proof of concept\n\n```go\napp := fiber.New()\napp.Use(cors.New(cors.Config{\n\tAllowOrigins:     \"https://*.example.com\",\n\tAllowCredentials: true,\n}))\napp.Get(\"/\", func(c *fiber.Ctx) error { return c.SendString(\"secret\") })\n```\n\nRequest with `Origin: https://evil-example.com`, as a GET and as a preflight (`OPTIONS` with `Access-Control-Request-Method: GET`):\n\n| Version | `https://evil-example.com` | `http://evil-example.com` |\n|---|---|---|\n| v2.52.0 | not allowed | not allowed |\n| v2.52.1, v2.52.2 | reflected, `Access-Control-Allow-Credentials: true` | reflected, `Access-Control-Allow-Credentials: true` |\n| v2.52.3 to v2.52.16 | not allowed | not allowed |\n\n### Impact\n\nAn app that configures a wildcard-subdomain `AllowOrigins` with `AllowCredentials: true` lets any page on a domain that ends with the base domain (for example `notexample.com` for `*.example.com`) read authenticated responses cross-origin. Fixed in v2.52.3; upgrade to the latest v2 release.\n\n### Other versions\n\nAll v2 releases before v2.52.16 also accepted origins with empty labels (`https://.example.com`, `https://a..example.com`), and v2.52.3 to v2.52.15 mis-parsed a wildcard entry after a comma and a space (`\"https://a.com, https://*.example.com\"`). No registrable domain produces such an origin, so these are hardening rather than part of this advisory. They are fixed in v2.52.16 (#4792).","status":"published","published":"2026-10-30T22:58:05Z","modified":"2026-10-30T22:58:08Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-346","CWE-942"],"updated_at":"2026-11-02T14:41:41.028239Z"}],"nvd":[{"id":"CVE-2026-119285","description":"Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3.","status":"published","published":"2026-10-29T22:17:01.367Z","modified":"2026-11-04T02:17:19.083Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-346","CWE-942"],"updated_at":"2026-11-04T06:53:34.694679Z"}],"osv":[{"id":"CVE-2026-119285","title":"Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads","description":"Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3.","status":"published","published":"2026-10-29T21:36:02.199Z","modified":"2026-11-05T23:25:41.631765189Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-346","CWE-942"],"updated_at":"2026-11-06T00:02:13.631839Z"},{"id":"GHSA-g5jq-qmqr-qrwf","title":"Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads","description":"### Summary\n\nIn v2.52.1 and v2.52.2 the CORS middleware matched a wildcard origin such as `https://*.example.com` by suffix only, without a dot boundary and without comparing the scheme. Any origin whose host ends with the base domain, for example `https://evil-example.com` or `http://notexample.com`, was reflected in `Access-Control-Allow-Origin`, together with `Access-Control-Allow-Credentials: true` when `AllowCredentials` is enabled.\n\nv2.52.3 replaced the matcher (#2915) and is not affected. The report was filed against v2.52.15, where the dot boundary holds; see \"Other versions\" below.\n\n### Details\n\nv2.52.1 introduced `validateDomain` in `middleware/cors/utils.go` (f0cd3b44, part of the fix for GHSA-fmg4-x8pw-hjhg). It strips scheme and port from both sides and then checks only the suffix, with `trimmedPattern = \"example.com\"`, so the character before the suffix is never checked:\n\n```go\nif strings.HasPrefix(normalizedPattern, \"*.\") {\n\ttrimmedPattern := normalizedPattern[2:]\n\tif strings.HasSuffix(normalizedDomain, trimmedPattern) {\n\t\tif normalizedDomain != trimmedPattern {\n\t\t\tif strings.TrimSuffix(normalizedDomain, trimmedPattern) != \"\" {\n\t\t\t\treturn true\n\t\t\t}\n\t\t}\n\t}\n}\n```\n\nv2.52.3 (1aac6f61, #2915) replaced it with a scheme-aware prefix/suffix split that keeps the leading dot in the suffix (`.example.com`).\n\n### Proof of concept\n\n```go\napp := fiber.New()\napp.Use(cors.New(cors.Config{\n\tAllowOrigins:     \"https://*.example.com\",\n\tAllowCredentials: true,\n}))\napp.Get(\"/\", func(c *fiber.Ctx) error { return c.SendString(\"secret\") })\n```\n\nRequest with `Origin: https://evil-example.com`, as a GET and as a preflight (`OPTIONS` with `Access-Control-Request-Method: GET`):\n\n| Version | `https://evil-example.com` | `http://evil-example.com` |\n|---|---|---|\n| v2.52.0 | not allowed | not allowed |\n| v2.52.1, v2.52.2 | reflected, `Access-Control-Allow-Credentials: true` | reflected, `Access-Control-Allow-Credentials: true` |\n| v2.52.3 to v2.52.16 | not allowed | not allowed |\n\n### Impact\n\nAn app that configures a wildcard-subdomain `AllowOrigins` with `AllowCredentials: true` lets any page on a domain that ends with the base domain (for example `notexample.com` for `*.example.com`) read authenticated responses cross-origin. Fixed in v2.52.3; upgrade to the latest v2 release.\n\n### Other versions\n\nAll v2 releases before v2.52.16 also accepted origins with empty labels (`https://.example.com`, `https://a..example.com`), and v2.52.3 to v2.52.15 mis-parsed a wildcard entry after a comma and a space (`\"https://a.com, https://*.example.com\"`). No registrable domain produces such an origin, so these are hardening rather than part of this advisory. They are fixed in v2.52.16 (#4792).","status":"published","published":"2026-10-30T22:58:05Z","modified":"2026-11-05T23:25:41.631765189Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-346","CWE-942"],"updated_at":"2026-11-06T00:02:13.631839Z"},{"id":"UBUNTU-CVE-2026-119285","description":"Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3.","status":"published","published":"2026-10-29T22:17:00Z","modified":"2026-11-05T04:42:51Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T13:33:25.727744Z"},{"id":"GO-2026-6896","title":"Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads in github.com/gofiber/fiber","description":"Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads in github.com/gofiber/fiber","status":"published","published":"2026-11-05T22:55:03Z","modified":"2026-11-05T23:15:16.271965657Z","updated_at":"2026-11-06T00:02:13.631839Z"}]}}