Go-chi - vulnerabilities (CVEs)

6 CVEs in 1 products, 2 in the last 30 days, newest from 2026-10-28.

Products

CVE-2026-118681 - CVSS 6.3 (medium), 2026-10-28: go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted…
CVE-2026-114437 - CVSS 6.3 (medium), 2026-10-21: In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the…
CVE-2026-72817 - CVSS 6.9 (medium), 2026-08-14: go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP…
CVE-2026-72816 - CVSS 6.9 (medium), 2026-08-14: go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled…
CVE-2026-72815 - CVSS 6.9 (medium), 2026-08-14: go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value…
CVE-2025-71405 - CVSS 5.1 (medium), 2026-08-14: chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect…