CVE-2026-119285 with a CVSS score of 5.9 is a cross-origin resource sharing configuration flaw in the CORS middleware of github.com/gofiber/fiber/v2, affecting versions v2.52.1 and v2.52.2. The middleware matched wildcard origin entries such as by suffix only, without enforcing a dot boundary and without comparing the URL scheme. As a result, an attacker-controlled origin whose host merely ended with the configured base domain, such as or could be reflected in Access-Control-Allow-Origin. When AllowCredentials was enabled, the response also included Access-Control-Allow-Credentials: true. The attack vector is network-based, requires high complexity and user interaction, and does not require prior authentication. A malicious web page can issue credentialed cross-origin requests to an affected application and read authenticated responses, potentially exposing sensitive user data, session information, or other protected resources. The flaw can undermine trust in the application's browser-enforced origin controls and may lead to unauthorized access to data that should be restricted to approved origins.
We recommend you to update Fiber to version 2.52.3.[/subscribe_to_unlock_form]
CVE-2026-119285 with a CVSS score of 5.9 is a cross-origin resource sharing configuration flaw in the CORS middleware of github.com/gofiber/fiber/v2, affecting versions v2.52.1 and v2.52.2. The middleware matched wildcard origin entries such as by suffix only, without enforcing a dot boundary and without comparing the URL scheme. As a result, an attacker-controlled origin whose host merely ended with the configured base domain, such as or could be reflected in Access-Control-Allow-Origin. When AllowCredentials was enabled, the response also included Access-Control-Allow-Credentials: true. The attack vector is network-based, requires high complexity and user interaction, and does not require prior authentication. A malicious web page can issue credentialed cross-origin requests to an affected application and read authenticated responses, potentially exposing sensitive user data, session information, or other protected resources. The flaw can undermine trust in the application's browser-enforced origin controls and may lead to unauthorized access to data that should be restricted to approved origins.
We recommend you to update Fiber to version 2.52.3.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]