Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's
    validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host
    suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins
    value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely
    ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin
    responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside
    this advisory. This issue is fixed in version 2.52.3. (CVE-2026-119285)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's     validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host     suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins     value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely     ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin     responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside     this advisory. This issue is fixed in version 2.52.3. (CVE-2026-119285)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478104	SCA: security update for github.com/gofiber/fiber/v2 (GHSA-g5jq-qmqr-qrwf)	Tenable Cloud Security	SCA Checks	Local	medium
478104	SCA: security update for github.com/gofiber/fiber/v2 (GHSA-g5jq-qmqr-qrwf)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
374478	Linux Distros Unpatched Vulnerability : CVE-2026-119285	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-119285

medium

Tenable Plugins

medium

medium

medium