{"action":"Upgrade github.com/gofiber/fiber/v2 to 2.52.1 or later.","affected":[{"fixed":"2.52.1","introduced":"0"}],"component":"github.com/gofiber/fiber/v2","cve_ids":["CVE-2024-25124"],"ecosystem":"Go","exploited":false,"fixed_versions":["2.52.1"],"ghsa_id":"GHSA-fmg4-x8pw-hjhg","id":"tcs_01M5KF9EMAMW5D9FSTTGVVEG5H","modified_at":"2026-09-10T03:50:06.174510650Z","published_at":"2024-02-22T18:25:18Z","references":["https://osv.dev/vulnerability/GHSA-fmg4-x8pw-hjhg","https://github.com/gofiber/fiber/security/advisories/GHSA-fmg4-x8pw-hjhg","https://nvd.nist.gov/vuln/detail/CVE-2024-25124","https://github.com/gofiber/fiber/commit/f0cd3b44b086544a37886232d0530601f2406c23","https://codeql.github.com/codeql-query-help/javascript/js-cors-misconfiguration-for-credentials","https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials","https://fetch.spec.whatwg.org/#cors-protocol-and-credentials","https://github.com/gofiber/fiber","https://github.com/gofiber/fiber/releases/tag/v2.52.1","https://saturncloud.io/blog/cors-cannot-use-wildcard-in-accesscontrolalloworigin-when-credentials-flag-is-true","http://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html"],"severity":{"label":"critical","score":9.4},"sources":[{"source":"osv","source_id":"GHSA-fmg4-x8pw-hjhg","url":"https://osv.dev/vulnerability/GHSA-fmg4-x8pw-hjhg"}],"summary":"Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials"}