CVE-2026-122132: go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware
go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301 Location header and resolve as a protocol-relative URL, bypassing the fix for CVE-2025-69725.
Event History
Frequently Asked Questions
Which deployments are affected?
Applications using go-chi chi versions 5.2.2 through 5.5.0 and the RedirectSlashes middleware are affected. The issue is reachable when that middleware processes attacker-controlled request paths.
What does an attacker need to exploit this issue?
No authentication is required, but an attacker must convince a victim to follow a crafted link. The link contains a URL-encoded tab character in the request path, causing the browser to interpret the redirect destination as a protocol-relative external URL.
What is the practical impact?
An attacker can use a trusted application's domain as part of a redirect chain to send victims to an external host. The provided severity vector indicates low confidentiality and integrity impact, with no availability impact.