Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
gorilla/handlers
main @ 9c61bd8
7
Fixes
1
CVEs
CRITICAL
Peak severity
42.9%
Coverage
Highlights
CORS Misconfiguration: 4 prior fixes. Scrutinize any change in this area.
cors.go: most-fixed (7 issues). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
CORS Misconfiguration: The CORS middleware previously reflected dynamic request origins when configured with wildcards or custom origin validators, which allowed arbitrary domains to bypass the Same Origin Policy. This flaw is tracking under CVE-2017-20146.
Auth Bypass: Unauthenticated HTTP OPTIONS preflight requests were historically forwarded directly to downstream application handlers instead of being intercepted and returned early. This bypasses downstream authentication controls that assume the CORS middleware handles preflight negotiation.
Auth Bypass: Concurrency and state-sharing flaws in CORS initialization allowed multiple handlers to overwrite a shared internal handler reference, resulting in the routing of authenticated requests to incorrect downstream application endpoints.