{"id":"CVE-2026-119285","aliases":["GHSA-g5jq-qmqr-qrwf"],"title":"Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads","titleSource":"GitHub_M","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"### Summary\n\nIn v2.52.1 and v2.52.2 the CORS middleware matched a wildcard origin such as `https://*.example.com` by suffix only, without a dot boundary and without comparing the scheme. Any origin whose host ends with the base domain, for example `https://evil-example.com` or `http://notexample.com`, was reflected in `Access-Control-Allow-Origin`, together with `Access-Control-Allow-Credentials: true` when `AllowCredentials` is enabled.\n\nv2.52.3 replaced the matcher (#2915) and is not affected. The report was filed against v2.52.15, where the dot boundary holds; see \"Other versions\" below.\n\n### Details\n\nv2.52.1 introduced `validateDomain` in `middleware/cors/utils.go` (f0cd3b44, part of the fix for GHSA-fmg4-x8pw-hjhg). It strips scheme and port from both sides and then checks only the suffix, with `trimmedPattern = \"example.com\"`, so the character before the suffix is never checked:\n\n```go\nif strings.HasPrefix(normalizedPattern, \"*.\") {\n\ttrimmedPattern := normalizedPattern[2:]\n\tif strings.HasSuffix(normalizedDomain, trimmedPattern) {\n\t\tif normalizedDomain != trimmedPattern {\n\t\t\tif strings.TrimSuffix(normalizedDomain, trimmedPattern) != \"\" {\n\t\t\t\treturn true\n\t\t\t}\n\t\t}\n\t}\n}\n```\n\nv2.52.3 (1aac6f61, #2915) replaced it with a scheme-aware prefix/suffix split that keeps the leading dot in the suffix (`.example.com`).\n\n### Proof of concept\n\n```go\napp := fiber.New()\napp.Use(cors.New(cors.Config{\n\tAllowOrigins:     \"https://*.example.com\",\n\tAllowCredentials: true,\n}))\napp.Get(\"/\", func(c *fiber.Ctx) error { return c.SendString(\"secret\") })\n```\n\nRequest with `Origin: https://evil-example.com`, as a GET and as a preflight (`OPTIONS` with `Access-Control-Request-Method: GET`):\n\n| Version | `https://evil-example.com` | `http://evil-example.com` |\n|---|---|---|\n| v2.52.0 | not allowed | not allowed |\n| v2.52.1, v2.52.2 | reflected, `Access-Control-Allow-Credentials: true` | reflected, `Access-Control-Allow-Credentials: true` |\n| v2.52.3 to v2.52.16 | not allowed | not allowed |\n\n### Impact\n\nAn app that configures a wildcard-subdomain `AllowOrigins` with `AllowCredentials: true` lets any page on a domain that ends with the base domain (for example `notexample.com` for `*.example.com`) read authenticated responses cross-origin. Fixed in v2.52.3; upgrade to the latest v2 release.\n\n### Other versions\n\nAll v2 releases before v2.52.16 also accepted origins with empty labels (`https://.example.com`, `https://a..example.com`), and v2.52.3 to v2.52.15 mis-parsed a wildcard entry after a comma and a space (`\"https://a.com, https://*.example.com\"`). No registrable domain produces such an origin, so these are hardening rather than part of this advisory. They are fixed in v2.52.16 (#4792).","severity":"medium","score":5.9,"published":"2026-10-29T21:36:02.199Z","modified":"2026-10-30T23:15:05.503Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Go","name":"github.com/gofiber/fiber/v2","sources":[{"name":"OSV · GHSA-g5jq-qmqr-qrwf","url":"https://osv.dev/vulnerability/GHSA-g5jq-qmqr-qrwf"}],"ranges":[{"events":[{"introduced":"2.52.1"},{"fixed":"2.52.3"}],"type":"SEMVER"}],"versions":[],"fixed":["2.52.3"]}],"sourceAffected":[],"references":["https://github.com/gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf","https://github.com/gofiber/fiber/pull/2915","https://github.com/gofiber/fiber/commit/1aac6f618b6bd3e159d2449acb4232a2170b976b","https://github.com/gofiber/fiber/releases/tag/v2.52.3","https://nvd.nist.gov/vuln/detail/CVE-2026-119285","https://github.com/gofiber/fiber"],"sources":[{"name":"CVE","id":"CVE-2026-119285","modified":"2026-10-29T21:36:02.199Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119285"},{"name":"OSV","id":"GHSA-g5jq-qmqr-qrwf","modified":"2026-10-30T23:15:05.503098884Z","url":"https://osv.dev/vulnerability/GHSA-g5jq-qmqr-qrwf"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","score":5.9},{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","score":5.9}],"cve":{"records":[{"id":"CVE-2026-119285","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-29T18:50:28.065Z","published":"2026-10-29T21:36:02.199Z","modified":"2026-10-29T21:36:02.199Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-29T21:36:02.199Z"}],"references":[{"url":"https://github.com/gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/gofiber/fiber/pull/2915","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/gofiber/fiber/commit/1aac6f618b6bd3e159d2449acb4232a2170b976b","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/gofiber/fiber/releases/tag/v2.52.3","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-346","description":"CWE-346: Origin Validation Error","source":"GitHub_M"},{"id":"CWE-942","description":"CWE-942: Permissive Cross-domain Policy with Untrusted Domains","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"products":[{"vendor":"gofiber","name":"fiber","platforms":[],"versions":[{"version":">= 2.52.1, < 2.52.3","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-119285"}],"remediation":[],"observedAt":"2026-10-30T23:32:48.912Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T00:40:31.812Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T23:00:44.188Z","attemptedAt":"2026-10-29T23:00:44.188Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-29T23:00:36.916Z","attemptedAt":"2026-10-29T23:00:36.916Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T23:00:37.983Z","attemptedAt":"2026-10-29T23:00:37.983Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T23:00:36.762Z","attemptedAt":"2026-10-29T23:00:36.762Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113402","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113402","modified":"Oct 29, 2026, 9:36:02 PM","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","checkedAt":"2026-10-29T23:00:37.983Z"},{"source":"NVD","id":"CVE-2026-119285","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119285","modified":"2026-10-29T22:17:01.367","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","checkedAt":"2026-10-29T23:00:44.188Z"}],"aiSummary":{"text":"Fiber versions 2.52.1 and 2.52.2 have a CORS vulnerability that allows credentialed cross-origin reads due to a wildcard origin matching issue without a dot boundary. This affects apps with wildcard-subdomain AllowOrigins and AllowCredentials: true. The issue is fixed in version 2.52.3.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T00:06:10.763Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-119285"},{"name":"OSV","url":"https://osv.dev/vulnerability/GHSA-g5jq-qmqr-qrwf"}]}}