GHSA-G5JQ-QMQR-QRWF
Vulnerability from github – Published: 2026-10-30 22:58 – Updated: 2026-10-30 22:58Summary
In v2.52.1 and v2.52.2 the CORS middleware matched a wildcard origin such as https://*.example.com by suffix only, without a dot boundary and without comparing the scheme. Any origin whose host ends with the base domain, for example https://evil-example.com or http://notexample.com, was reflected in Access-Control-Allow-Origin, together with Access-Control-Allow-Credentials: true when AllowCredentials is enabled.
v2.52.3 replaced the matcher (#2915) and is not affected. The report was filed against v2.52.15, where the dot boundary holds; see "Other versions" below.
Details
v2.52.1 introduced validateDomain in middleware/cors/utils.go (f0cd3b44, part of the fix for GHSA-fmg4-x8pw-hjhg). It strips scheme and port from both sides and then checks only the suffix, with trimmedPattern = "example.com", so the character before the suffix is never checked:
if strings.HasPrefix(normalizedPattern, "*.") {
trimmedPattern := normalizedPattern[2:]
if strings.HasSuffix(normalizedDomain, trimmedPattern) {
if normalizedDomain != trimmedPattern {
if strings.TrimSuffix(normalizedDomain, trimmedPattern) != "" {
return true
}
}
}
}
v2.52.3 (1aac6f61, #2915) replaced it with a scheme-aware prefix/suffix split that keeps the leading dot in the suffix (.example.com).
Proof of concept
app := fiber.New()
app.Use(cors.New(cors.Config{
AllowOrigins: "https://*.example.com",
AllowCredentials: true,
}))
app.Get("/", func(c *fiber.Ctx) error { return c.SendString("secret") })
Request with Origin: https://evil-example.com, as a GET and as a preflight (OPTIONS with Access-Control-Request-Method: GET):
| Version | https://evil-example.com |
http://evil-example.com |
|---|---|---|
| v2.52.0 | not allowed | not allowed |
| v2.52.1, v2.52.2 | reflected, Access-Control-Allow-Credentials: true |
reflected, Access-Control-Allow-Credentials: true |
| v2.52.3 to v2.52.16 | not allowed | not allowed |
Impact
An app that configures a wildcard-subdomain AllowOrigins with AllowCredentials: true lets any page on a domain that ends with the base domain (for example notexample.com for *.example.com) read authenticated responses cross-origin. Fixed in v2.52.3; upgrade to the latest v2 release.
Other versions
All v2 releases before v2.52.16 also accepted origins with empty labels (https://.example.com, https://a..example.com), and v2.52.3 to v2.52.15 mis-parsed a wildcard entry after a comma and a space ("https://a.com, https://*.example.com"). No registrable domain produces such an origin, so these are hardening rather than part of this advisory. They are fixed in v2.52.16 (#4792).
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.52.2"
},
"package": {
"ecosystem": "Go",
"name": "github.com/gofiber/fiber/v2"
},
"ranges": [
{
"events": [
{
"introduced": "2.52.1"
},
{
"fixed": "2.52.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-119285"
],
"database_specific": {
"cwe_ids": [
"CWE-346",
"CWE-942"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-30T22:58:05Z",
"nvd_published_at": "2026-10-29T22:17:01Z",
"severity": "MODERATE"
},
"details": "### Summary\n\nIn v2.52.1 and v2.52.2 the CORS middleware matched a wildcard origin such as `https://*.example.com` by suffix only, without a dot boundary and without comparing the scheme. Any origin whose host ends with the base domain, for example `https://evil-example.com` or `http://notexample.com`, was reflected in `Access-Control-Allow-Origin`, together with `Access-Control-Allow-Credentials: true` when `AllowCredentials` is enabled.\n\nv2.52.3 replaced the matcher (#2915) and is not affected. The report was filed against v2.52.15, where the dot boundary holds; see \"Other versions\" below.\n\n### Details\n\nv2.52.1 introduced `validateDomain` in `middleware/cors/utils.go` (f0cd3b44, part of the fix for GHSA-fmg4-x8pw-hjhg). It strips scheme and port from both sides and then checks only the suffix, with `trimmedPattern = \"example.com\"`, so the character before the suffix is never checked:\n\n```go\nif strings.HasPrefix(normalizedPattern, \"*.\") {\n\ttrimmedPattern := normalizedPattern[2:]\n\tif strings.HasSuffix(normalizedDomain, trimmedPattern) {\n\t\tif normalizedDomain != trimmedPattern {\n\t\t\tif strings.TrimSuffix(normalizedDomain, trimmedPattern) != \"\" {\n\t\t\t\treturn true\n\t\t\t}\n\t\t}\n\t}\n}\n```\n\nv2.52.3 (1aac6f61, #2915) replaced it with a scheme-aware prefix/suffix split that keeps the leading dot in the suffix (`.example.com`).\n\n### Proof of concept\n\n```go\napp := fiber.New()\napp.Use(cors.New(cors.Config{\n\tAllowOrigins: \"https://*.example.com\",\n\tAllowCredentials: true,\n}))\napp.Get(\"/\", func(c *fiber.Ctx) error { return c.SendString(\"secret\") })\n```\n\nRequest with `Origin: https://evil-example.com`, as a GET and as a preflight (`OPTIONS` with `Access-Control-Request-Method: GET`):\n\n| Version | `https://evil-example.com` | `http://evil-example.com` |\n|---|---|---|\n| v2.52.0 | not allowed | not allowed |\n| v2.52.1, v2.52.2 | reflected, `Access-Control-Allow-Credentials: true` | reflected, `Access-Control-Allow-Credentials: true` |\n| v2.52.3 to v2.52.16 | not allowed | not allowed |\n\n### Impact\n\nAn app that configures a wildcard-subdomain `AllowOrigins` with `AllowCredentials: true` lets any page on a domain that ends with the base domain (for example `notexample.com` for `*.example.com`) read authenticated responses cross-origin. Fixed in v2.52.3; upgrade to the latest v2 release.\n\n### Other versions\n\nAll v2 releases before v2.52.16 also accepted origins with empty labels (`https://.example.com`, `https://a..example.com`), and v2.52.3 to v2.52.15 mis-parsed a wildcard entry after a comma and a space (`\"https://a.com, https://*.example.com\"`). No registrable domain produces such an origin, so these are hardening rather than part of this advisory. They are fixed in v2.52.16 (#4792).",
"id": "GHSA-g5jq-qmqr-qrwf",
"modified": "2026-10-30T22:58:05Z",
"published": "2026-10-30T22:58:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119285"
},
{
"type": "WEB",
"url": "https://github.com/gofiber/fiber/pull/2915"
},
{
"type": "WEB",
"url": "https://github.com/gofiber/fiber/commit/1aac6f618b6bd3e159d2449acb4232a2170b976b"
},
{
"type": "PACKAGE",
"url": "https://github.com/gofiber/fiber"
},
{
"type": "WEB",
"url": "https://github.com/gofiber/fiber/releases/tag/v2.52.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.