MEDIUM5.4
GO-2025-3955
CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http
Quick fix
GO-2025-3955 — stdlib: upgrade to the fixed version with the command below.
go get stdlib@v1.25.1Details
When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.
Are you affected?
Enter the version of the package you're using.