{"id":"CVE-2026-122132","kind":"vulnerability","aliases":["CVE-2026-122132"],"related":[],"title":"chi router: RedirectSlashes middleware enables open redirect via tab characters","description":"go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301 Location header and resolve as a protocol-relative URL, bypassing the fix for CVE-2025-69725.","summary":"The RedirectSlashes middleware in the go-chi chi Go router, versions 5.2.2 through 5.5.0, can be made to send a 301 redirect to an external host when a request path contains an encoded tab character. An attacker can use a crafted link to send victims to a site of their choice, and the redirect bypasses the earlier fix for CVE-2025-69725.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chi","go","package","web-services"],"not_affected_if":["chi-not-used","redirectslashes-not-enabled"],"how_to_check":"- Check the chi version in the Go module file: `go list -m github.com/go-chi/chi/v5`\n- Look for use of the `middleware.RedirectSlashes` handler in the router setup code.","fix":null,"status":"open","published_at":"2026-11-04T21:18:08+00:00","first_seen_at":"2026-11-04T21:49:19+00:00","triaged_at":"2026-11-04T21:51:16+00:00","updated_at":"2026-11-04T21:51:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T21:51:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"chi router: RedirectSlashes middleware enables open redirect via tab characters","impact":"low","summary":"The RedirectSlashes middleware in the go-chi chi Go router, versions 5.2.2 through 5.5.0, can be made to send a 301 redirect to an external host when a request path contains an encoded tab character. An attacker can use a crafted link to send victims to a site of their choice, and the redirect bypasses the earlier fix for CVE-2025-69725.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","chi","web-services"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"victims are redirected to an attacker-chosen external website","analyst_note":"Confirm the fixed chi version and whether a patch exists; check the vendor advisory on github.com and the VulnCheck advisory.","how_to_check":"- Check the chi version in the Go module file: `go list -m github.com/go-chi/chi/v5`\n- Look for use of the `middleware.RedirectSlashes` handler in the router setup code.","plain_action":"","needs_analyst":true,"not_affected_if":["chi-not-used","redirectslashes-not-enabled"],"who_is_affected":"Applications written in Go that use the chi router and enable the RedirectSlashes middleware are exposed, because the redirect is generated by that middleware. Services that do not use chi, or that do not register RedirectSlashes, are not affected by this flaw. The sources do not describe further conditions.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000711,"input_tokens":4219,"output_tokens":579,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-122132':13A,16A '-2025':84B,149C '-2026':12A,15A '-69725':85B,150C '301':44B,133C '5.2.2':35B,90C '5.5.0':37B,92C 'allow':103C 'attack':60B,104C,118C 'browser':129C 'bypass':78B,144C 'charact':10A,58B,114C 'chi':1A,17B,30B,31B,88C,89C 'choic':74B 'contain':54B,93C 'craft':64B,120C 'cve':11A,14A,83B,148C 'earlier':80B 'embed':112C 'enabl':5A 'encod':56B,126C 'extern':48B,109C 'fix':81B,146C 'go':18B,29B,32B,87C 'go-chi':28B,86C 'header':135C 'host':49B,110C 'link':65B,121C 'locat':134C 'made':40B 'middlewar':4A,25B,101C 'open':6A,95C 'packag':19B 'path':53B,117C 'protocol':141C 'protocol-rel':140C 'redirect':7A,45B,77B,96C,106C 'redirectslash':3A,24B,100C 'relat':142C 'request':52B,116C 'resolv':137C 'router':2A,33B 'send':42B,67B 'servic':22B 'site':71B 'strip':130C 'tab':9A,57B,113C,127C 'url':125C,143C 'url-encod':124C 'use':62B 'version':34B 'via':8A 'victim':68B,107C 'vulner':97C 'web':21B 'web-servic':20B","nicknames":[],"mitigations":[],"who_affected":"Applications written in Go that use the chi router and enable the RedirectSlashes middleware are exposed, because the redirect is generated by that middleware. Services that do not use chi, or that do not register RedirectSlashes, are not affected by this flaw. The sources do not describe further conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["chi","go","medium","package","webservices"],"campaign_type":null,"first_public_at":"2026-01-14T16:06:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122132","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122132","severity":null,"published_at":"2026-11-04T21:18:08+00:00","modified_at":"2026-11-04T21:18:09+00:00","first_seen_at":"2026-11-04T21:49:19+00:00","fetched_at":"2026-11-04T21:49:19+00:00","note":null}],"documents":[{"id":70656,"url":"https://github.com/go-chi/chi/security/advisories/GHSA-mqqf-5wvp-8fh8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-01-14T16:06:13+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":70657,"url":"https://www.vulncheck.com/advisories/go-chi-chi-5.2.2-through-5.5.0-open-redirect-via-redirectslashes-middleware","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}