Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3.

Source published

29 Oct 2026 21:36:02 UTC

Source modified

4 Nov 2026 01:55:09 UTC

Saved here

4 Nov 2026 02:57:16 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 3.1 · 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3.

Source published

Oct 29, 2026, 9:36:02 PM (timezone not stated)

Source modified

Nov 4, 2026, 1:55:09 AM (timezone not stated)

Saved here

14 Nov 2026 07:10:53 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 3.1 · 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3.

Source published

29 Oct 2026 22:17:01 UTC

Source modified

4 Nov 2026 02:17:19 UTC

Saved here

6 Nov 2026 01:43:49 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 3.1 · [email protected] · Secondary · 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

### Summary In v2.52.1 and v2.52.2 the CORS middleware matched a wildcard origin such as `https://*.example.com` by suffix only, without a dot boundary and without comparing the scheme. Any origin whose host ends with the base domain, for example `https://evil-example.com` or `http://notexample.com`, was reflected in `Access-Control-Allow-Origin`, together with `Access-Control-Allow-Credentials: true` when `AllowCredentials` is enabled. v2.52.3 replaced the matcher (#2915) and is not affected. The report was filed against v2.52.15, where the dot boundary holds; see "Other versions" below. ### Details v2.52.1 introduced `validateDomain` in `middleware/cors/utils.go` (f0cd3b44, part of the fix for GHSA-fmg4-x8pw-hjhg). It strips scheme and port from both sides and then checks only the suffix, with `trimmedPattern = "example.com"`, so the character before the suffix is never checked: ```go if strings.HasPrefix(normalizedPattern, "*.") { trimmedPattern := normalizedPattern[2:] if strings.HasSuffix(normalizedDomain, trimmedPattern) { if normalizedDomain != trimmedPattern { if strings.TrimSuffix(normalizedDomain, trimmedPattern) != "" { return true } } } } ``` v2.52.3 (1aac6f61, #2915) replaced it with a scheme-aware prefix/suffix split that keeps the leading dot in the suffix (`.example.com`). ### Proof of concept ```go app := fiber.New() app.Use(cors.New(cors.Config{ AllowOrigins: "https://*.example.com", AllowCredentials: true, })) app.Get("/", func(c *fiber.Ctx) error { return c.SendString("secret") }) ``` Request with `Origin: https://evil-example.com`, as a GET and as a preflight (`OPTIONS` with `Access-Control-Request-Method: GET`): | Version | `https://evil-example.com` | `http://evil-example.com` | |---|---|---| | v2.52.0 | not allowed | not allowed | | v2.52.1, v2.52.2 | reflected, `Access-Control-Allow-Credentials: true` | reflected, `Access-Control-Allow-Credentials: true` | | v2.52.3 to v2.52.16 | not allowed | not allowed | ### Impact An app that configures a wildcard-subdomain `AllowOrigins` with `AllowCredentials: true` lets any page on a domain that ends with the base domain (for example `notexample.com` for `*.example.com`) read authenticated responses cross-origin. Fixed in v2.52.3; upgrade to the latest v2 release. ### Other versions All v2 releases before v2.52.16 also accepted origins with empty labels (`https://.example.com`, `https://a..example.com`), and v2.52.3 to v2.52.15 mis-parsed a wildcard entry after a comma and a space (`"https://a.com, https://*.example.com"`). No registrable domain produces such an origin, so these are hardening rather than part of this advisory. They are fixed in v2.52.16 (#4792).

Source published

30 Oct 2026 22:58:05 UTC

Source modified

5 Nov 2026 23:25:41 UTC

Saved here

5 Nov 2026 23:38:32 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

Publisher rating · MODERATE

Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads in github.com/gofiber/fiber

Source published

5 Nov 2026 22:55:03 UTC

Source modified

5 Nov 2026 23:15:16 UTC

Saved here

5 Nov 2026 23:38:32 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.