Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads

Also known as GHSA-g5jq-qmqr-qrwf, GO-2026-6896

Published 9 d ago 2026-10-29 · modified 2 d ago 2026-11-05 · JSON

CVSS

5.9

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.1%

percentile 3%

Public exploits

none known

Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3.

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: no
Technical impact: partial
Assessed: 4 d ago 2026-11-04

Exploit prediction (EPSS)

0.13% probability of exploitation in the next 30 days, higher than 3% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	5.9	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N`
CNA	3.1	5.9	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N`
GitHub	3.1	5.9	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
go	`github.com/gofiber/fiber/v2`	>=2.52.1, <2.52.3	2.52.3

Affected products

gofiber fiber

Classification

Weakness

CWE-346 Origin Validation Error
CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains

References

github.com /gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf · x_refsource_CONFIRM, exploit
github.com /gofiber/fiber/pull/2915 · x_refsource_MISC
github.com /gofiber/fiber/commit/1aac6f618b6bd3e159d2449acb4232a2170b976b · x_refsource_MISC
github.com /gofiber/fiber/releases/tag/v2.52.3 · x_refsource_MISC
nvd.nist.gov /vuln/detail/CVE-2026-119285 · advisory
github.com /gofiber/fiber · package

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary