CVE-2026-122132 · Package
NO FIX YET
The RedirectSlashes middleware in the go-chi chi Go router, versions 5.2.2 through 5.5.0, can be made to send a 301 redirect to an external host when a request path contains an encoded tab character. An attacker can use a crafted link to send victims to a site of their choice, and the redirect bypasses the earlier fix for CVE-2025-69725.
first public Jan 14, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications written in Go that use the chi router and enable the RedirectSlashes middleware are exposed, because the redirect is generated by that middleware. Services that do not use chi, or that do not register RedirectSlashes, are not affected by this flaw. The sources do not describe further conditions.
Not affected if chi-not-used, redirectslashes-not-enabled
Who cares chi, go, web-services
go list -m github.com/go-chi/chi/v5middleware.RedirectSlashes handler in the router setup code.No fix yet, per the sources.
go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301 Location header and resolve as a protocol-relative URL, bypassing the fix for CVE-2025-69725.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.