# github.com/go-chi/chi/v5 (Go) vulnerabilities

7 known vulnerabilities (7 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: v5.5.0 (Oct 14, 2026): no advisory affects it
- Newest unaffected release: v5.5.0 (Oct 14, 2026), the latest release
- Releases: 27 since v5.0.0 (Feb 28, 2021)
- Registry: https://pkg.go.dev/github.com/go-chi/chi/v5
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-122132: v5.2.2 to v5.2.3 (v5.2.4 is outside it)
- CVE-2026-114437: v5.0.0 to v5.3.2 (v5.4.0 is outside it)
- CVE-2026-72817: v5.0.0 to v5.2.5 (v5.3.0 is outside it)
- CVE-2026-72816: v5.0.0 to v5.2.5 (v5.3.0 is outside it)
- CVE-2026-72815: v5.2.1 to v5.2.5 (v5.3.0 is outside it)
- CVE-2025-71405: v5.0.0 to v5.2.1 (v5.2.2 is outside it)
- CVE-2025-69725: v5.2.2 to v5.2.3 (v5.2.4 is outside it)

## Advisories (7)

### [CVE-2026-122132](https://cve.now/CVE-2026-122132): go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware

- Severity: Medium 5.1
- Published: Nov 4, 2026
- Affected: from 5.2.2, fixed in 5.2.4.
- Fixed in v5.2.4 (released Jan 14, 2026, 294 days before disclosure).
- The latest release, v5.5.0, is not affected.

### [CVE-2026-114437](https://cve.now/CVE-2026-114437): Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For

- Severity: Medium 4.8
- Published: Oct 21, 2026
- Affected: fixed in 5.4.0.
- Fixed in v5.4.0 (released Oct 12, 2026, 9 days before disclosure).
- The latest release, v5.5.0, is not affected.

### [CVE-2026-72817](https://cve.now/CVE-2026-72817): go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-For

- Severity: Medium 6.9
- Published: Aug 14, 2026
- Affected: fixed in 5.3.0.
- Fixed in v5.3.0 (released May 22, 2026, 84 days before disclosure).
- The latest release, v5.5.0, is not affected.

### [CVE-2026-72816](https://cve.now/CVE-2026-72816): go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware

- Severity: Medium 6.9
- Published: Aug 14, 2026
- Affected: fixed in 5.3.0.
- Fixed in v5.3.0 (released May 22, 2026, 84 days before disclosure).
- The latest release, v5.5.0, is not affected.

### [CVE-2026-72815](https://cve.now/CVE-2026-72815): go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header

- Severity: Medium 6.9
- Published: Aug 14, 2026
- Affected: from 5.2.1, fixed in 5.3.0.
- Fixed in v5.3.0 (released May 22, 2026, 84 days before disclosure).
- The latest release, v5.5.0, is not affected.

### [CVE-2025-71405](https://cve.now/CVE-2025-71405): go-chi chi before v5.2.2 Open Redirect via RedirectSlashes

- Severity: Medium 5.1
- Published: Aug 14, 2026
- Affected: fixed in 5.2.2; from 5.2.1, fixed in 5.2.2.
- Fixed in v5.2.2 (released Jun 20, 2025, 420 days before disclosure).
- The latest release, v5.5.0, is not affected.

### [CVE-2025-69725](https://cve.now/CVE-2025-69725): An Open Redirect vulnerability in the go-chi/chi \>=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to…

- Severity: Medium 4.7
- Published: Feb 19, 2026
- Affected: from 5.2.2, fixed in 5.2.4.
- Fixed in v5.2.4 (released Jan 14, 2026, 36 days before disclosure).
- The latest release, v5.5.0, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/go-chi/chi/v5
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.