CVE-2026-119285
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Fiber is an Express-inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain.
Risk Assessment
A user visiting that origin can expose authenticated cross-origin responses to the attacker's page, leading to session data leakage and confidentiality breach.
Recommendation
Upgrade Fiber to version 2.52.3 or later and avoid combining wildcard subdomains in AllowOrigins with AllowCredentials.
Other vulnerabilities in Fiber
See all- CVE-2026-53624Medium
In the Fiber web framework for Go prior to version 3.4.0, the helmet middleware incorrectly checks the protocol using c.Protocol() instead of c.Scheme(), causing the Strict-Transport-Security header to never be set even when HSTSMaxAge is configured. This issue is fixed in version 3.4.0.
- CVE-2026-45045Medium
In the Fiber web framework for Go, prior to versions 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting the X-Real-IP header. This allows an attacker to supply a first X-Real-IP value that gets forwarded to upstream servers for logging, rate limiting, and access control.
- CVE-2026-44332Medium
In the Fiber web framework for Go prior to version 3.3.0, the default Authorizer function in the BasicAuth middleware uses short-circuit evaluation that skips password hash comparison for non-existent usernames. This allows reliable remote username enumeration through response timing differences.
- CVE-2026-42554Medium
Prior to 2.52.12 and 3.1.0, a Cross-Site Scripting vulnerability in Go Fiber allows a remote attacker to inject arbitrary HTML/JavaScript by supplying Accept: text/html on any request whose handler passes attacker-influenced data to the AutoFormat() feature. This vulnerability is fixed in 2.52.12 and 3.1.0.
- CVE-2026-30246Medium
In the Fiber web framework for Go through version 3.1.0, the default key generator in the cache middleware uses only the request path and omits the query string. As a result, requests to the same path with different query parameters can share a cache key and receive the wrong cached response. The issue is fixed after version 3.1.0.
Original NVD description (English source)
Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS