go-chi has 14 CVEs on record. Cadence is steady at roughly 7 per quarter. The busiest recent month was August 2026 with 5. The median CVSS is 5.1 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-290 (4) and CWE-345 (3). Most affected products: github.com/go-chi/chi/v5 (6), chi (4), github.com/go-chi/chi/middleware (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.1
- Publish → KEV
- —
- Last 90 days
- 7 prev 6
Products
- github.com/go-chi/chi/v5 6
- chi 4
- github.com/go-chi/chi/middleware 2
- github.com/go-chi/chi 1
- github.com/go-chi/chi/v5/middleware 1
Worst active — by depth score
CVE-2026-72815Medium· 6.9go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header50CVE-2026-72816Medium· 6.5go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go)48GHSA-rjr7-jggh-pgcpHighchi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header41GHSA-9g5q-2w5x-hmxfHighchi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution41CVE-2025-71405Medium· 5.1chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs40
go-chi vulnerabilities
CVEs affecting go-chi, newest first. Open any entry for full detail, references, and exploit status.
14 CVEsRSS
CVE-2026-114437Medium· 4.8PoCchi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For
chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For
GHSA-7cgw-qmxx-7fc2Medium· 4.8Duplicate Advisory: chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For
Duplicate Advisory: chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For
GHSA-xcvf-46f4-xwxfMediumDuplicate Advisory: chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes
Duplicate Advisory: chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes
CVE-2025-71405Medium· 5.1PoCchi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs
chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary ho…
CVE-2026-72816Medium· 6.5PoCgo-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go)
go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.Remot…
CVE-2026-72817Medium· 6.5go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted …
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted …
CVE-2026-72815Medium· 6.9PoCgo-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header
go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access…
GO-2026-5777NoneChi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi
Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi
GO-2026-5775NoneChi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi
Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi
GO-2026-5774NoneChi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi
Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi
GHSA-rjr7-jggh-pgcpHighchi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header
chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header
GHSA-9g5q-2w5x-hmxfHighchi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution
chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution
GHSA-3fxj-6jh8-hvhxMediumchi Has an IP Spoofing Vulnerability in `middleware.RealIP`
chi Has an IP Spoofing Vulnerability in `middleware.RealIP`
CVE-2025-69725Medium· 4.7chi has an open redirect vulnerability in the RedirectSlashes middleware
chi has an open redirect vulnerability in the RedirectSlashes middleware