{"affected":[{"product":"fiber","source":"CNA: GitHub_M","vendor":"gofiber","versions":[{"status":"affected","version":">= 2.52.1, < 2.52.3"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/gofiber/fiber/v2","product":"github.com/gofiber/fiber/v2","source":"OSV GHSA-g5jq-qmqr-qrwf","vendor":"","versions":[{"events":[{"introduced":"2.52.1"},{"fixed":"2.52.3"}],"lessThan":"2.52.3","status":"affected","version":"2.52.1","versionType":"semver"}]}],"cveId":"CVE-2026-119285","cwes":["CWE-346","CWE-942"],"description":"Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3.","epss":{"date":"2026-11-03","percentile":0.02528,"score":0.00129},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf"}],"kev":null,"metrics":[{"score":5.9,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","version":"3.1"}],"modifiedAt":1793757309920,"publishedAt":1793309762199,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/gofiber/fiber/pull/2915"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/gofiber/fiber/commit/1aac6f618b6bd3e159d2449acb4232a2170b976b"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/gofiber/fiber/releases/tag/v2.52.3"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-g5jq-qmqr-qrwf"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-g5jq-qmqr-qrwf"}],"remediation":[{"kind":"fix","source":"OSV GHSA-g5jq-qmqr-qrwf","text":"github.com/gofiber/fiber/v2 (Go): OSV reports a fixed version 2.52.3. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-g5jq-qmqr-qrwf"}],"revision":"ce13f62e28c175d127714c06acfe996dd6ffd0c288a2ec8c721621f8125a659b","sources":[{"modifiedAt":1793757309920,"name":"CNA: GitHub_M","retrievedAt":1793758151435,"url":"https://www.cve.org/CVERecord?id=CVE-2026-119285"},{"modifiedAt":1793402105503,"name":"OSV / GitHub Security Advisories","retrievedAt":1793758152211,"url":"https://osv.dev/vulnerability/GHSA-g5jq-qmqr-qrwf"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793758170190,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-119285"}],"ssvc":{"assessedAt":1793757289126,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads","updatedAt":1793758170190}