Connected evidence
Follow a shared identifier, source page or planning group across source records. Dates show chronology; a connection does not establish cause, a shared rollout or applicability to your environment.
Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads
Lead record- Why these records are connected
- Records explicitly naming the same CVE identifier.
- Connection key
cve:CVE-2026-119285- Public snapshot refreshed
- today 14:48 UTC
- Distinct source events
- 5
- Source records represented
- 5
Current snapshot membership is shown here. Source histories and cited revisions remain on each record. Future source targets are labelled separately from observed changes. Browse connections.
Evidence in chronological order
- Thu 29 Oct · Dated source evidence · Newly collected advisory Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin readsCVE-2026-119285 Source: Derived from the linked evidence · source check: not recorded hereYour review: not selected in your watchlist or stack; no review is inferred.Newly collected advisory; observed by ChangeIntel, not the original publication date.
- Fri 30 Oct · Dated source evidence · Newly collected advisory Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin readsGHSA-g5jq-qmqr-qrwf Source: Derived from the linked evidence · source check: not recorded hereYour review: not selected in your watchlist or stack; no review is inferred.Newly collected advisory; observed by ChangeIntel, not the original publication date.
- Mon 2 Nov · Dated source evidence · Advisory content revised Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot bo…EUVD-2026-113402 Source: Derived from the linked evidence · source check: not recorded hereYour review: not selected in your watchlist or stack; no review is inferred.Advisory content revised; observed by ChangeIntel, not the original publication date.
- Thu 5 Nov · Dated source evidence · Advisory content revised Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin readsGHSA-g5jq-qmqr-qrwf Source: Derived from the linked evidence · source check: not recorded hereYour review: not selected in your watchlist or stack; no review is inferred.Advisory content revised; observed by ChangeIntel, not the original publication date.
- Thu 5 Nov · Dated source evidence · Newly collected advisory Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads in github.com/gofiber/fiberGO-2026-6896 Source: Derived from the linked evidence · source check: not recorded hereYour review: not selected in your watchlist or stack; no review is inferred.Newly collected advisory; observed by ChangeIntel, not the original publication date.