---
title: "GHSA-vhxv-fg4m-p2w8: Some CORS middleware allow untrusted origins"
url: https://erroneo.us/security/ghsa/GHSA-vhxv-fg4m-p2w8/
description: "GHSA-vhxv-fg4m-p2w8 (critical, Go): Some CORS middleware allow untrusted origins. Impact Some CORS middleware (more specifically those created by specifying…"
type: advisory
section: "Security Digest"
date_published: 2024-05-03
date_modified: 2024-05-21
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-vhxv-fg4m-p2w8"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-vhxv-fg4m-p2w8: Some CORS middleware allow untrusted origins

## Affected packages

- Go `github.com/jub0bs/cors` < 0.1.3 → fixed: 0.1.3

## Details

Impact Some CORS middleware (more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix) incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question. For example, specifying origin patterns https://foo.com and https://bar.com (in that order) would yield a middleware that would incorrectly allow untrusted origin https://barfoo.com. Patches Patched in v0.1.3. Workarounds None.

## Sources

- [GitHub Advisory GHSA-vhxv-fg4m-p2w8](https://github.com/advisories/GHSA-vhxv-fg4m-p2w8)
- [github.com](https://github.com/jub0bs/cors/security/advisories/GHSA-vhxv-fg4m-p2w8)
- [github.com](https://github.com/jub0bs/cors/commit/5bc0648a32db2d600179a50866f648f4d7090363)
- [github.com](https://github.com/jub0bs/cors/commit/63900fa1776237095fa0ed47ff85791e21f3a7d7)

---
Source page: https://erroneo.us/security/ghsa/GHSA-vhxv-fg4m-p2w8/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt