{"id":"CVE-2026-119285","aliases":["GHSA-g5jq-qmqr-qrwf"],"url":"https://o3.security/vulnerability/CVE-2026-119285","summary":"Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads","details":"### Summary\n\nIn v2.52.1 and v2.52.2 the CORS middleware matched a wildcard origin such as `https://*.example.com` by suffix only, without a dot boundary and without comparing the scheme. Any origin whose host ends with the base domain, for example `https://evil-example.com` or `http://notexample.com`, was reflected in `Access-Control-Allow-Origin`, together with `Access-Control-Allow-Credentials: true` when `AllowCredentials` is enabled.\n\nv2.52.3 replaced the matcher (#2915) and is not affected. The report was filed against v2.52.15, where the dot boundary holds; see \"Other versions\" below.\n\n### Details\n\nv2.52.1 introduced `validateDomain` in `middleware/cors/utils.go` (f0cd3b44, part of the fix for GHSA-fmg4-x8pw-hjhg). It strips scheme and port from both sides and then checks only the suffix, with `trimmedPattern = \"example.com\"`, so the character before the suffix is never checked:\n\n```go\nif strings.HasPrefix(normalizedPattern, \"*.\") {\n\ttrimmedPattern := normalizedPattern[2:]\n\tif strings.HasSuffix(normalizedDomain, trimmedPattern) {\n\t\tif normalizedDomain != trimmedPattern {\n\t\t\tif strings.TrimSuffix(normalizedDomain, trimmedPattern) != \"\" {\n\t\t\t\treturn true\n\t\t\t}\n\t\t}\n\t}\n}\n```\n\nv2.52.3 (1aac6f61, #2915) replaced it with a scheme-aware prefix/suffix split that keeps the leading dot in the suffix (`.example.com`).\n\n### Proof of concept\n\n```go\napp := fiber.New()\napp.Use(cors.New(cors.Config{\n\tAllowOrigins:     \"https://*.example.com\",\n\tAllowCredentials: true,\n}))\napp.Get(\"/\", func(c *fiber.Ctx) error { return c.SendString(\"secret\") })\n```\n\nRequest with `Origin: https://evil-example.com`, as a GET and as a preflight (`OPTIONS` with `Access-Control-Request-Method: GET`):\n\n| Version | `https://evil-example.com` | `http://evil-example.com` |\n|---|---|---|\n| v2.52.0 | not allowed | not allowed |\n| v2.52.1, v2.52.2 | reflected, `Access-Control-Allow-Credentials: true` | reflected, `Access-Control-Allow-Credentials: true` |\n| v2.52.3 to v2.52.16 | not allowed | not allowed |\n\n### Impact\n\nAn app that configures a wildcard-subdomain `AllowOrigins` with `AllowCredentials: true` lets any page on a domain that ends with the base domain (for example `notexample.com` for `*.example.com`) read authenticated responses cross-origin. Fixed in v2.52.3; upgrade to the latest v2 release.\n\n### Other versions\n\nAll v2 releases before v2.52.16 also accepted origins with empty labels (`https://.example.com`, `https://a..example.com`), and v2.52.3 to v2.52.15 mis-parsed a wildcard entry after a comma and a space (`\"https://a.com, https://*.example.com\"`). No registrable domain produces such an origin, so these are hardening rather than part of this advisory. They are fixed in v2.52.16 (#4792).","published":"2026-10-29T21:36:02.199Z","modified":"2026-10-31T02:47:35.158444363Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/gofiber/fiber/v2","fixedVersion":"2.52.3"}],"fix":{"url":"https://github.com/gofiber/fiber/commit/1aac6f618b6bd3e159d2449acb4232a2170b976b","label":"gofiber/fiber@1aac6f6"},"references":[{"type":"WEB","url":"https://github.com/gofiber/fiber/releases/tag/v2.52.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119285.json"},{"type":"ADVISORY","url":"https://github.com/gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119285"},{"type":"FIX","url":"https://github.com/gofiber/fiber/commit/1aac6f618b6bd3e159d2449acb4232a2170b976b"},{"type":"FIX","url":"https://github.com/gofiber/fiber/pull/2915"},{"type":"PACKAGE","url":"https://github.com/gofiber/fiber"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-31T02:47:35.158444363Z"}}