CVE-2026-114437: Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For
In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP.
This issue affects chi before 5.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
chito a version that resolves this vulnerability.Fixed in 5.4.0
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications using affected Chi versions before 5.4.0 that enable ClientIPFromXFF are exposed if clients can connect directly to the Go server. The issue is relevant where middleware.GetClientIP is relied on for decisions based on the apparent client address.
What does an attacker need to exploit it?
An attacker needs network access to reach the Go server directly and must be able to send an X-Forwarded-For header. No authentication or user interaction is required, but exploitation depends on a configured trusted CIDR and the ability to include an address that appears to be within it.
Are deployments behind a trusted proxy affected by default?
The described weakness is specifically that the middleware does not verify whether the direct TCP peer in http.Request.RemoteAddr is in the configured trusted CIDR. A deployment that prevents direct client access to the Go server removes the direct-access condition described for exploitation.
How can I determine whether my application is affected?
Check whether it uses Chi before 5.4.0 and enables ClientIPFromXFF with trusted CIDRs. Then determine whether an untrusted client can connect directly to the Go server rather than only through the intended proxy.