CVE-2026-122132
go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301 Location header and resolve as a protocol-relative URL, bypassing the fix for CVE-2025-69725.
| CWE | CWE-601 |
| Vendor | go-chi |
| Product | chi |
| Published | Nov 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for go-chi chi
Be the first to know when new medium vulnerabilities affecting go-chi chi are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
go-chi / chi
5.2.2 ≤ 5.5.0
References
github.com: https://github.com/go-chi/chi/pull/1238 github.com: https://github.com/go-chi/chi github.com: https://github.com/go-chi/chi/security/advisories/GHSA-mqqf-5wvp-8fh8 github.com: https://github.com/go-chi/chi/blob/v5.5.0/middleware/strip.go#L41-L69 vulncheck.com: https://www.vulncheck.com/advisories/go-chi-chi-5.2.2-through-5.5.0-open-redirect-via-redirectslashes-middleware
Credits
Zachariah Mithani (AploSec)