MediumVulnerabilityCVE-2026-119285updated 30 Oct 2026, 22:58 UTC
Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads
Fixed in github.com/gofiber/fiber/v2 2.52.3 · out Official source
| Severity | MediumCVSS 5.9 of 10 |
|---|---|
| Being exploited? | UnclearNo reports either way yet |
| Fix available? | Yesgithub.com/gofiber/fiber/v2 2.52.3 · since 30 Oct 2026 |
| How sure is this? | Official sourceBacked by an official source |
Are you affected?
| Package / product | Affected versions | Fixed in |
|---|---|---|
| github.com/gofiber/fiber/v2 · go | >= 2.52.1, <= 2.52.2 | 2.52.3 |
Timeline
- 30 Oct 2026, 22:58 UTCPublicly disclosed
- 30 Oct 2026, 22:58 UTCReported by GitHub Advisory · GitHub Advisory
- 30 Oct 2026, 22:58 UTCPicked up by Zero Radar
Sources 1 report, oldest first
Official vendor, government CERT or advisory database
- Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin readsGitHub Advisory · 30 Oct 2026, 22:58 UTC
Technical details
- ID
- CVE-2026-119285 · GHSA-g5jq-qmqr-qrwf
- CVSS
- 5.9 / 10
- Disclosed
- 30 Oct 2026, 22:58 UTC
- On Zero Radar
- 30 Oct 2026, 22:58 UTC (0 min after disclosure)
- Last change
- 30 Oct 2026, 22:58 UTC
This entry has not been explained yet. The text comes straight from the source. How Zero Radar works