{"id":"GHSA-v84h-653v-4pq9","aliases":["GO-2024-2812"],"url":"https://o3.security/vulnerability/GHSA-v84h-653v-4pq9","summary":"Some CORS middleware allow untrusted origins","details":"### Impact\n\nSome CORS middleware (more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix) incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question.\n\nFor example, specifying origin patterns `https://foo.com` and `https://bar.com` (in that order) would yield a middleware that would incorrectly allow untrusted origin `https://barfoo.com`.\n\n### Patches\n\nPatched in v0.9.0.\n\n### Workarounds\n\nNone.\n","published":"2024-05-03T17:34:21Z","modified":"2026-02-04T03:34:24.057878Z","cvss":{"score":9.3,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/jub0bs/fcors","fixedVersion":"0.9.0"}],"fix":{"url":"https://github.com/jub0bs/fcors/commit/08d85c149a418a583315cee066d4a35cc817219d","label":"jub0bs/fcors@08d85c1"},"references":[{"type":"WEB","url":"https://github.com/jub0bs/fcors/security/advisories/GHSA-v84h-653v-4pq9"},{"type":"WEB","url":"https://github.com/jub0bs/fcors/commit/08d85c149a418a583315cee066d4a35cc817219d"},{"type":"WEB","url":"https://github.com/jub0bs/fcors/commit/b5dcb889a49def37d7d9c25deb7135f4eb45625e"},{"type":"PACKAGE","url":"https://github.com/jub0bs/fcors"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-02-04T03:34:24.057878Z"}}