CVE-2026-119285: medium-severity vulnerability in gofiber fiber
Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.9epss 0.1%
Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Affected products
gofiber · fiberRelated CVEs — gofiber fiber
In the same product, most dangerous first.
CVE-2020-15111MEDIUMCRLF vulnerability in FiberEPSS 0.9%CVE-2026-25891HIGHFiber has an Arbitrary File Read in Static Middleware on WindowsEPSS 0.7%CVE-2024-38513CRITICALFiber Session Middleware Token Injection VulnerabilityEPSS 0.7%CVE-2026-25882MEDIUMFiber has a Denial of Service Vulnerability via Route Parameter OverflowEPSS 0.7%CVE-2024-25124CRITICALFiber has Insecure CORS Configuration, Allowing Wildcard Origin with CredentialsEPSS 0.7%CVE-2023-41338MEDIUMVulnerability in Ctx.IsFromLocal() in gofiberEPSS 0.7%