{"id":"GHSA-v84h-653v-4pq9","aliases":["GO-2024-2812"],"status":"published","title":"Some CORS middleware allow untrusted origins","description":"### Impact\n\nSome CORS middleware (more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix) incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question.\n\nFor example, specifying origin patterns `https://foo.com` and `https://bar.com` (in that order) would yield a middleware that would incorrectly allow untrusted origin `https://barfoo.com`.\n\n### Patches\n\nPatched in v0.9.0.\n\n### Workarounds\n\nNone.","severity":{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-05-03T17:34:21Z","modified":"2026-02-04T04:32:51Z","fixes":[{"ecosystem":"Go","package":"github.com/jub0bs/fcors","fixed_in":["0.9.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/jub0bs/fcors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.8.0"},{"fixed":"0.9.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/jub0bs/fcors","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/jub0bs/fcors","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.0"}]}]}],"references":[{"url":"https://github.com/jub0bs/fcors/security/advisories/GHSA-v84h-653v-4pq9","tags":["web","advisory"]},{"url":"https://github.com/jub0bs/fcors/commit/08d85c149a418a583315cee066d4a35cc817219d","tags":["web"]},{"url":"https://github.com/jub0bs/fcors/commit/b5dcb889a49def37d7d9c25deb7135f4eb45625e","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-v84h-653v-4pq9"},{"url":"https://github.com/jub0bs/fcors","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-v84h-653v-4pq9","title":"Some CORS middleware allow untrusted origins","description":"### Impact\n\nSome CORS middleware (more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix) incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question.\n\nFor example, specifying origin patterns `https://foo.com` and `https://bar.com` (in that order) would yield a middleware that would incorrectly allow untrusted origin `https://barfoo.com`.\n\n### Patches\n\nPatched in v0.9.0.\n\n### Workarounds\n\nNone.\n","status":"published","published":"2024-05-03T17:34:21Z","modified":"2024-05-21T15:39:24Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T14:37:51.549437Z"}],"osv":[{"id":"GHSA-v84h-653v-4pq9","title":"Some CORS middleware allow untrusted origins","description":"### Impact\n\nSome CORS middleware (more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix) incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question.\n\nFor example, specifying origin patterns `https://foo.com` and `https://bar.com` (in that order) would yield a middleware that would incorrectly allow untrusted origin `https://barfoo.com`.\n\n### Patches\n\nPatched in v0.9.0.\n\n### Workarounds\n\nNone.\n","status":"published","published":"2024-05-03T17:34:21Z","modified":"2026-02-04T03:34:24.057878Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:46:56.981655Z"},{"id":"GO-2024-2812","title":"Some CORS middleware allow untrusted origins in github.com/jub0bs/fcors","description":"Some CORS middleware (more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix) incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question.\n\nFor example, specifying origin patterns \"https://foo.com\" and \"https://bar.com\" (in that order) would yield a middleware that would incorrectly allow untrusted origin \"https://barfoo.com\".","status":"published","published":"2024-05-21T15:08:01Z","modified":"2026-02-04T04:32:51.776553Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}