{"id":"CVE-2026-119285","kind":"vulnerability","aliases":["CVE-2026-119285"],"related":[],"title":"Fiber: CORS wildcard origin matching lets unrelated sites read authenticated responses","description":"Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3.","summary":"Fiber's CORS middleware matches wildcard subdomain origins by host suffix without requiring a dot boundary, so an attacker-controlled domain ending in the configured base domain is reflected as allowed. When credentials are enabled, a logged-in user visiting that domain lets the attacker's page read authenticated cross-origin responses.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cors","fiber","go","runtime","self-hosted"],"not_affected_if":["credentials-disabled","no-wildcard-origins","version-outside-2.52.1-2.52.2"],"how_to_check":"- Check the Fiber module version in `go.mod`; affected versions are from `2.52.1` up to but not including `2.52.3`.\n- Search the Go code for `cors.New` and `AllowOrigins` using a wildcard subdomain value such as `https://*.example.com`.\n- Check whether `AllowCredentials` is set to `true` in the same CORS configuration.","fix":"- Fiber: upgrade to `2.52.3`.","status":"open","published_at":"2026-10-29T22:17:01+00:00","first_seen_at":"2026-10-29T22:27:06+00:00","triaged_at":"2026-10-29T22:28:57+00:00","updated_at":"2026-10-29T22:28:57+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-29T22:28:57Z","model":"claude-haiku-5-5","output":{"fix":"- Fiber: upgrade to `2.52.3`.","reach":"internet","title":"Fiber: CORS wildcard origin matching lets unrelated sites read authenticated responses","impact":"medium","summary":"Fiber's CORS middleware matches wildcard subdomain origins by host suffix without requiring a dot boundary, so an attacker-controlled domain ending in the configured base domain is reflected as allowed. When credentials are enabled, a logged-in user visiting that domain lets the attacker's page read authenticated cross-origin responses.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["go","fiber","cors","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker's page reads logged-in user's cross-origin API responses.","analyst_note":"","how_to_check":"- Check the Fiber module version in `go.mod`; affected versions are from `2.52.1` up to but not including `2.52.3`.\n- Search the Go code for `cors.New` and `AllowOrigins` using a wildcard subdomain value such as `https://*.example.com`.\n- Check whether `AllowCredentials` is set to `true` in the same CORS configuration.","plain_action":"","needs_analyst":false,"not_affected_if":["no-wildcard-origins","credentials-disabled","version-outside-2.52.1-2.52.2"],"who_is_affected":"Applications built with Fiber that use the CORS middleware with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled are exposed. Apps without wildcard origins or without credentials enabled, and apps not using the affected version range, can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001227,"input_tokens":4238,"output_tokens":1606,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119285':14A,17A '-2026':13A,16A '2.52.1':91C '2.52.3':93C,186C 'advisori':179C 'allow':56B 'allowcredenti':128C 'alloworigin':125C 'applic':118C 'attack':44B,71B,135C,162C 'attacker-control':43B,134C 'authent':10A,75B,155C 'base':51B,145C 'boundari':40B,116C 'check':107C 'comma':172C 'comma-spac':171C 'configur':50B,119C,144C 'control':45B,136C 'cor':2A,18B,27B,95C 'credenti':58B 'cross':77B,157C 'cross-origin':76B,156C 'cve':12A,15A 'domain':46B,52B,68B,146C 'dot':39B,115C 'empti':166C 'empty-label':165C 'enabl':60B,129C 'end':47B,141C 'expos':154C 'express':83C 'fiber':1A,19B,25B,80C 'fix':183C 'framework':86C 'go':20B,89C 'harden':175C 'host':24B,34B,110C,139C 'inspir':84C 'issu':181C 'label':167C 'later':170C 'let':6A,69B 'log':63B 'logged-in':62B 'match':5A,29B 'matcher':100C 'mere':140C 'middlewar':28B,96C 'middleware/cors/utils.go':102C 'origin':4A,32B,78B,137C,152C,158C,168C 'outsid':177C 'page':73B,164C 'pars':174C 'read':9A,74B 'reflect':54B,131C 'requir':37B,113C 'respons':11A,79B,159C 'runtim':21B 'scheme':105C 'self':23B 'self-host':22B 'site':8A 'space':173C 'strip':103C 'subdomain':31B,124C 'suffix':35B,111C 'unrel':7A,133C 'user':65B,148C 'validatedomain':98C 'valu':126C 'version':185C 'visit':66B,150C 'web':85C 'whose':138C 'wildcard':3A,30B,99C,123C 'wildcard-subdomain':122C 'without':36B,112C 'written':87C","nicknames":[],"mitigations":[],"who_affected":"Applications built with Fiber that use the CORS middleware with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled are exposed. Apps without wildcard origins or without credentials enabled, and apps not using the affected version range, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T22:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119285","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119285","severity":null,"published_at":"2026-10-29T22:17:01+00:00","modified_at":"2026-10-29T22:17:01+00:00","first_seen_at":"2026-10-29T22:27:06+00:00","fetched_at":"2026-10-29T22:27:06+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}