---
id: "CVE-2026-122132"
kind: "vulnerability"
aliases: ["CVE-2026-122132"]
title: "chi router: RedirectSlashes middleware enables open redirect via tab characters"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["chi", "go", "package", "web-services"]
not_affected_if: ["chi-not-used", "redirectslashes-not-enabled"]
published_at: "2026-11-04T21:18:08+00:00"
first_seen_at: "2026-11-04T21:49:19+00:00"
updated_at: "2026-11-04T21:51:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122132", "first_seen_at": "2026-11-04T21:49:19+00:00"}]
exploit_sources: []
---

# chi router: RedirectSlashes middleware enables open redirect via tab characters

The RedirectSlashes middleware in the go-chi chi Go router, versions 5.2.2 through 5.5.0, can be made to send a 301 redirect to an external host when a request path contains an encoded tab character. An attacker can use a crafted link to send victims to a site of their choice, and the redirect bypasses the earlier fix for CVE-2025-69725.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the chi version in the Go module file: `go list -m github.com/go-chi/chi/v5`
- Look for use of the `middleware.RedirectSlashes` handler in the router setup code.

## Timeline

- 2026-11-04T21:49:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122132

## Documents

- [advisory] Vendor advisory: github.com https://github.com/go-chi/chi/security/advisories/GHSA-mqqf-5wvp-8fh8
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/go-chi-chi-5.2.2-through-5.5.0-open-redirect-via-redirectslashes-middleware

## From the sources

go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301 Location header and resolve as a protocol-relative URL, bypassing the fix for CVE-2025-69725.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_