CVE-2026-119285— Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads

Quick assessment

Affected

gofiber fiber

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Fiber 是一个受 Express 启发、使用 Go 语言编写的 Web 框架。在 2.52.1 至 2.52.3 版本中，CORS 中间件（位于 middleware/cors/utils.go）的 validateDomain 通配符匹配器会剥离 URL 方案（scheme），仅检查主机名的后缀，且未要求后缀前必须存在点号（"."）边界。若应用程序配置了带通配符子域的 AllowOrigins 值，并启用了 AllowCredentials，则攻击者可构造一个无关的、其主机名仅以配置的基础域名结尾的源，从而被

CVSS 5.9 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1055.001 · Dynamic-link Library Injection T1566.002 · Spearphishing Link

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads

Source: CVE Program / CVE List V5

Vulnerability Description

Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

源验证错误

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
gofiber	fiber	>= 2.52.1, < 2.52.3	-

II. Public POCs for CVE-2026-119285

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119285

请登录查看更多情报信息。

Other References for CVE-2026-119285 (4)

https://github.com/gofiber/fiber/pull/2915 x_refsource_MISC
https://github.com/gofiber/fiber/releases/tag/v2.52.3 x_refsource_MISC
https://github.com/gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf x_refsource_CONFIRM
https://github.com/gofiber/fiber/commit/1aac6f618b6bd3e159d2449acb4232a2170b976b x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-119285

IV. Related Vulnerabilities

Same product: fiber

Same vendor: gofiber

Same weakness: CWE-346