CVE-2026-122132
go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes…
- Risk score
- 40/100
- CVSS
- 6.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 4 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301 Location header and reso…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.1 medium
References
- https://github.com/go-chi/chi
- https://github.com/go-chi/chi/blob/v5.5.0/middleware/strip.go#L41-L69
- https://github.com/go-chi/chi/pull/1238
- https://github.com/go-chi/chi/security/advisories/GHSA-mqqf-5wvp-8fh8
- https://www.vulncheck.com/advisories/go-chi-chi-5.2.2-through-5.5.0-open-redirect-via-redirectslashes-middleware
Original description
go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301 Location header and resolve as a protocol-relative URL, bypassing the fix for CVE-2025-69725.
Last activity 4 Nov 2026. Patch Forecast updates every hour.