Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
rs/cors
master @ 2f30c9c
6
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Auth Bypass: 3 prior fixes. Scrutinize any change in this area.
cors.go: most-fixed (6 issues). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Preflight OPTIONS requests could bypass downstream authentication middleware by traversing the entire handler chain instead of terminating early in the CORS middleware.
Auth Bypass: Allowing credentials when the allowed origins configuration contains a wildcard ('*') resulted in reflecting the incoming origin, permitting unauthorized cross-origin reading of credentialed responses.
CORS Misconfiguration: Failure to consistently set or append the Vary header ('Vary: Origin' and 'Vary: Access-Control-Request-Private-Network') allowed caching proxies to serve mismatched CORS headers to different clients, resulting in cache poisoning or unauthorized resource exposure.