CORS Middleware Vulnerability in Fiber Web Framework by GoFiber

CVE-2026-119285

What is CVE-2026-119285?

The Fiber web framework, versions 2.52.1 to 2.52.3, contains a vulnerability in the CORS middleware's validateDomain function. This issue arises because the wildcard matcher fails to enforce a dot boundary when validating host suffixes. As a result, applications with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled could inadvertently allow access from attacker-controlled origins, which could lead to the exposure of sensitive cross-origin responses to the attacker's webpage. Users should be aware that this can facilitate unauthorized access and potential exploitation. The problem has been addressed in Fiber version 2.52.3.

References