---
title: "GHSA-v84h-653v-4pq9: Some CORS middleware allow untrusted origins"
url: https://erroneo.us/security/ghsa/GHSA-v84h-653v-4pq9/
description: "GHSA-v84h-653v-4pq9 (critical, Go): Some CORS middleware allow untrusted origins. Impact Some CORS middleware (more specifically those created by specifying…"
type: advisory
section: "Security Digest"
date_published: 2024-05-03
date_modified: 2024-05-21
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-v84h-653v-4pq9"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-v84h-653v-4pq9: Some CORS middleware allow untrusted origins

## Affected packages

- Go `github.com/jub0bs/fcors` <= 0.8.0 → fixed: 0.9.0

## Details

Impact Some CORS middleware (more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix) incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question. For example, specifying origin patterns https://foo.com and https://bar.com (in that order) would yield a middleware that would incorrectly allow untrusted origin https://barfoo.com. Patches Patched in v0.9.0. Workarounds None.

## Sources

- [GitHub Advisory GHSA-v84h-653v-4pq9](https://github.com/advisories/GHSA-v84h-653v-4pq9)
- [github.com](https://github.com/jub0bs/fcors/security/advisories/GHSA-v84h-653v-4pq9)
- [github.com](https://github.com/jub0bs/fcors/commit/08d85c149a418a583315cee066d4a35cc817219d)
- [github.com](https://github.com/jub0bs/fcors/commit/b5dcb889a49def37d7d9c25deb7135f4eb45625e)

---
Source page: https://erroneo.us/security/ghsa/GHSA-v84h-653v-4pq9/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt