SZB-e192b8174e
EUVD lists CVSS 5.9 CORS wildcard matching flaw in Fiber 2.52.1 to 2.52.3
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- gofiber
- Product
- fiber
- First seen
Summary
The EUVD entry EUVD-2026-113402 reports that Fiber versions 2.52.1 through 2.52.3 have a CORS middleware wildcard matcher that checks only a host suffix without a dot boundary. The item gives a CVSS v3.1 score of 5.9.
If you use gofiber
Upgrade Fiber to a release after 2.52.3
Review CORS allow-list settings that use wildcard domains
What the sources say 1
· Mastodon: “From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary.” Source