CVE-2026-119285 in Fiber
Summary
by MITRE • 10/30/2026
Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified within the Fiber web framework, specifically affecting versions from 2.52.1 through 2.52.3, represents a critical flaw in the Cross-Origin Resource Sharing middleware implementation. This issue stems from an insufficient validation logic employed by the wildcard domain matcher located in the utility file for CORS handling. When developers configure the AllowOrigins directive to accept requests from subdomains using a wildcard pattern, such as allowing access from *.example.com, the framework is designed to verify that the incoming request's origin matches this allowed list before permitting credential-based cross-origin interactions. However, the specific implementation flaw lies in how the host portion of the origin URL is parsed and compared against the configured base domain. The validation logic strips the scheme (http or https) from the input but fails to enforce a strict dot boundary when checking for suffix matches. This oversight allows an attacker to craft a malicious origin that technically ends with the allowed base domain string without being a legitimate subdomain of it, thereby bypassing the intended security controls.
From a technical perspective, this flaw enables what is known as a wildcard subdomain confusion attack or host header injection variant depending on context, though here it specifically facilitates unauthorized cross-origin data access. By leveraging the lack of dot boundary enforcement, an attacker can register a domain such as evil-example.com if example.com was the allowed base. Since evil-example.com ends with the string example.com, the flawed matcher incorrectly identifies it as a valid subdomain match. When combined with the AllowCredentials setting being enabled for this origin pattern, the browser will include cookies and other authentication credentials in cross-origin requests made from pages hosted on the attacker-controlled domain. This means that any web application using Fiber versions 2.52.1 to 2.52.3 with these specific CORS configurations becomes susceptible to Cross-Site Request Forgery attacks where sensitive data can be exfiltrated, or state-changing actions can be performed under the victim's identity without their consent. The impact is severe as it undermines the fundamental isolation guarantees provided by the Same-Origin Policy in modern web browsers.
This vulnerability aligns with CWE-20 Improper Input Validation and more specifically relates to CWE-942 Cross-Site Scripting via Permitted Untrusted Data Sources when considering the potential for data exfiltration, although its primary classification is often associated with improper access control mechanisms like CWE-862 Missing Authorization. In terms of offensive security frameworks, this behavior maps directly to MITRE ATT&CK technique T1534 Internal Spearphishing or more accurately T1071 Application Layer Protocol for lateral movement and data exfiltration in the context of web applications, specifically exploiting misconfigured access controls (T1608). The exploitation requires a user with valid authentication tokens to visit a malicious site controlled by an adversary. Once there, JavaScript code on that page can initiate fetch requests or XMLHttpRequests targeting the vulnerable Fiber application. Because the CORS middleware incorrectly validates the origin as allowed due to the suffix matching flaw, the browser permits the response containing sensitive data back to the attacker's script, leading to unauthorized disclosure of user-specific information such as session tokens, personal details, or financial records.
Mitigation for this vulnerability is straightforward and was addressed in version 2.52.3 of the Fiber framework. Developers must upgrade their dependencies to include at least version 2.52.3 where the wildcard matcher has been corrected to enforce proper dot boundaries during host validation. This ensures that only actual subdomains, such as api.example.com for a base domain example.com, are considered valid matches, preventing domains like evil-example.com from being accepted. In addition to upgrading, organizations should review their CORS configurations to ensure they adhere to the principle of least privilege. It is recommended to avoid using broad wildcard patterns in AllowOrigins whenever possible and instead explicitly list trusted origins if feasible. Furthermore, ensuring that AllowCredentials is only enabled for strictly necessary endpoints and domains reduces the attack surface significantly. Regular security audits and static analysis tools should be employed to detect similar misconfigurations in web application frameworks before deployment to production environments.