{"id":"CVE-2026-119285","aliases":["GHSA-g5jq-qmqr-qrwf"],"title":"Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads","summary":"Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","vendor":"gofiber","product":"github.com/gofiber/fiber/v2","ecosystem":"go","affected":["github.com/gofiber/fiber/v2 >= 2.52.1, < 2.52.3"],"patched":["github.com/gofiber/fiber/v2 2.52.3"],"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T23:15:05.503098884Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-g5jq-qmqr-qrwf","references":[{"url":"https://github.com/gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119285"},{"url":"https://github.com/gofiber/fiber/pull/2915"},{"url":"https://github.com/gofiber/fiber/commit/1aac6f618b6bd3e159d2449acb4232a2170b976b"},{"url":"https://github.com/gofiber/fiber"},{"url":"https://github.com/gofiber/fiber/releases/tag/v2.52.3"},{"url":"https://github.com/advisories/GHSA-g5jq-qmqr-qrwf"}],"tags":["osv","go","ghsa"],"epss":0.00129,"epssPercentile":0.02489,"cwe":["CWE-346","CWE-942"],"ingestedAt":"2026-10-30T23:11:25.784Z","slug":"CVE-2026-119285","body":"## Overview\n\n### Summary\n\nIn v2.52.1 and v2.52.2 the CORS middleware matched a wildcard origin such as `https://*.example.com` by suffix only, without a dot boundary and without comparing the scheme. Any origin whose host ends with the base domain, for example `https://evil-example.com` or `http://notexample.com`, was reflected in `Access-Control-Allow-Origin`, together with `Access-Control-Allow-Credentials: true` when `AllowCredentials` is enabled.\n\nv2.52.3 replaced the matcher (#2915) and is not affected. The report was filed against v2.52.15, where the dot boundary holds; see \"Other versions\" below.\n\n### Details\n\nv2.52.1 introduced `validateDomain` in `middleware/cors/utils.go` (f0cd3b44, part of the fix for GHSA-fmg4-x8pw-hjhg). It strips scheme and port from both sides and then checks only the suffix, with `trimmedPattern = \"example.com\"`, so the character before the suffix is never checked:\n\n```go\nif strings.HasPrefix(normalizedPattern, \"*.\") {\n\ttrimmedPattern := normalizedPattern[2:]\n\tif strings.HasSuffix(normalizedDomain, trimmedPattern) {\n\t\tif normalizedDomain != trimmedPattern {\n\t\t\tif strings.TrimSuffix(normalizedDomain, trimmedPattern) != \"\" {\n\t\t\t\treturn true\n\t\t\t}\n\t\t}\n\t}\n}\n```\n\nv2.52.3 (1aac6f61, #2915) replaced it with a scheme-aware prefix/suffix split that keeps the leading dot in the suffix (`.example.com`).\n\n### Proof of concept\n\n```go\napp := fiber.New()\napp.Use(cors.New(cors.Config{\n\tAllowOrigins:     \"https://*.example.com\",\n\tAllowCredentials: true,\n}))\napp.Get(\"/\", func(c *fiber.Ctx) error { return c.SendString(\"secret\") })\n```\n\nRequest with `Origin: https://evil-example.com`, as a GET and as a preflight (`OPTIONS` with `Access-Control-Request-Method: GET`):\n\n| Version | `https://evil-example.com` | `http://evil-example.com` |\n|---|---|---|\n| v2.52.0 | not allowed | not allowed |\n| v2.52.1, v2.52.2 | reflected, `Access-Control-Allow-Credentials: true` | reflected, `Access-Control-Allow-Credentials: true` |\n| v2.52.3 to v2.52.16 | not allowed | not allowed |\n\n### Impact\n\nAn app that configures a wildcard-subdomain `AllowOrigins` with `AllowCredentials: true` lets any page on a domain that ends with the base domain (for example `notexample.com` for `*.example.com`) read authenticated responses cross-origin. Fixed in v2.52.3; upgrade to the latest v2 release.\n\n### Other versions\n\nAll v2 releases before v2.52.16 also accepted origins with empty labels (`https://.example.com`, `https://a..example.com`), and v2.52.3 to v2.52.15 mis-parsed a wildcard entry after a comma and a space (`\"https://a.com, https://*.example.com\"`). No registrable domain produces such an origin, so these are hardening rather than part of this advisory. They are fixed in v2.52.16 (#4792).\n\n## Affected packages\n\n- `github.com/gofiber/fiber/v2 >= 2.52.1, < 2.52.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/gofiber/fiber/v2 2.52.3`","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":32.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}