{"id":"GHSA-rqrp-8cg2-5958","kind":"vulnerability","aliases":["GHSA-rqrp-8cg2-5958"],"related":[],"title":"SupressNotFound reuses mutable route state, allowing a mounted request to reach an outer public handler with tenant scope","description":"### Summary\r\n\r\n# SupressNotFound reuses mutable route state, allowing a mounted request to reach an outer public handler with tenant scope\r\n\r\n## Summary\r\n\r\nIn go-chi/chi v5.4.0, `middleware.SupressNotFound` calls `Match` with the live request routing context. `Match` is documented to mutate that context. In the tested collision configuration, the preflight match descends through a mounted router, leaves the mount parameter in `URLParams`, and sets the child suffix in `RoutePath`. The subsequent dispatch uses the changed path against the outer router. Because the outer router also has a public route for that suffix, its handler runs instead of the mounted route, so the mounted child’s authentication middleware is skipped. A separate mounted-only control has the generated outer parameter mount `/{tenant}` but no explicit root `GET /settings` endpoint; without this middleware, authenticated `/acme/settings` reaches the child handler, while with it that request returns 404. This shows a broader mounted-routing failure. The security impact demonstrated here is narrower: it requires a suffix collision and an outer public handler that trusts the retained mount parameter.\r\n\r\nA local exact-version reproduction uses `Router.Route`, which creates and mounts a subrouter, with distinct route chains around a shared tenant-aware handler. The outer route serves public-scope data when no tenant parameter exists. The mounted route applies authentication and uses the same handler for tenant data. Normally, unauthenticated `GET /acme/data/42` is denied (401), an authenticated request reaches the mounted handler, and direct `GET /data/42` returns only `tenant=public`. With `SupressNotFound` enabled on the outer router, both unauthenticated and authenticated `GET /acme/data/42` are handled by the outer public route, which receives the retained `tenant=acme` parameter through `Request.PathValue` and `chi.URLParam` and returns the synthetic `acme` resource. The harness observes both APIs; source inspection confirms `chi.URLParam` reads the same retained routing-context parameters. The demonstrated disclosure therefore depends on the application reusing a tenant-aware handler on an outer route that is otherwise public; an outer route that independently enforces authorization would not have this impact.\r\n\r\n\r\n\r\n### Details\r\n\r\n## Affected version and source path\r\n\r\n- Verified version: go-chi/chi v5.4.0, tag commit 7f9b7448f51d28804fac98c0a17bc2a7cec1079f.\r\n- middleware/supress_notfound.go:18-24 retrieves the live RouteContext, calls Match, then continues normal dispatch.\r\n- mux.go:367-382 documents that Match/Find update the supplied context.\r\n- mux.go:397-398 changes RoutePath while descending into a mounted router.\r\n- mux.go:276-285 shows that `Router.Route` creates a subrouter and mounts it.\r\n- tree.go:383-405 appends matched route parameters to URLParams.\r\n- mux.go:459-491 dispatches using a non-empty RoutePath and calls the standard library's `Request.SetPathValue` with retained URLParams.\r\n- context.go:10-20 and 122-130 show that `chi.URLParam` reads the same retained URLParams from the request routing context.\r\n- Historical source-only comparison found the same `SupressNotFound` implementation in v5.0.12, v5.1.0, v5.2.0, v5.3.0, and the tested v5.4.0: [v5.0.12 source](https://raw.githubusercontent.com/go-chi/chi/v5.0.12/middleware/supress_notfound.go), [v5.1.0 source](https://raw.githubusercontent.com/go-chi/chi/v5.1.0/middleware/supress_notfound.go), [v5.2.0 source](https://raw.githubusercontent.com/go-chi/chi/v5.2.0/middleware/supress_notfound.go), [v5.3.0 source](https://raw.githubusercontent.com/go-chi/chi/v5.3.0/middleware/supress_notfound.go). The older versions were not run. These checks suggest a multi-release affected range, but do not identify the first affected or a fixed release; exact-build runtime evidence is only for v5.4.0.\r\n\r\n\r\n\r\n### Proof of concept\r\n\r\n## Reproduction\r\n\r\nThis `httptest` program uses synthetic data and does not contact an external service. The quoted output was produced with Go 1.26.6 against a clean checkout of exact v5.4.0 tag commit `7f9b7448f51d28804fac98c0a17bc2a7cec1079f`; no module or toolchain download was needed. The verified directory layout is `chi-v5.4.0-preflight/source/` for that checkout and `chi-v5.4.0-preflight/evidence/supress-notfound-scope/{go.mod,main.go}` for the harness. The included `go.mod` uses a local `replace` to `../../source`; it does not fetch chi from the module proxy. To reproduce, place a clean v5.4.0 checkout at the adjacent `source/` path, verify its commit with `git -C source rev-parse HEAD`, and run the command below. Chi v5.4.0's `go.mod` declares Go 1.24; the observed run used Go 1.26.6.\r\n\r\nUse the included `main.go` and `go.mod` under `evidence/supress-notfound-scope/`, alongside the exact source checkout in `source/`. The standalone harness requires Go 1.24 or newer:\r\n\r\n```text\r\nmodule example.invalid/supressnotfound-poc\r\n\r\ngo 1.24\r\n\r\nrequire github.com/go-chi/chi/v5 v5.4.0\r\n\r\nreplace github.com/go-chi/chi/v5 => ../../source\r\n```\r\n\r\nFrom that directory, run `GOPROXY=off GOSUMDB=off GOTOOLCHAIN=local go run .` to use the local v5.4.0 source without module or toolchain downloads.\r\n\r\n```go\r\npackage main\r\n\r\nimport (\r\n\t\"fmt\"\r\n\t\"net/http\"\r\n\t\"net/http/httptest\"\r\n\r\n\t\"github.com/go-chi/chi/v5\"\r\n\t\"github.com/go-chi/chi/v5/middleware\"\r\n)\r\n\r\nfunc requireToken(next http.Handler) http.Handler {\r\n\treturn http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\r\n\t\tif r.Header.Get(\"Authorization\") != \"Bearer local-test\" {\r\n\t\t\thttp.Error(w, \"auth required\", http.StatusUnauthorized)\r\n\t\t\treturn\r\n\t\t}\r\n\t\tnext.ServeHTTP(w, r)\r\n\t})\r\n}\r\n\r\nfunc servedBy(name string, next http.Handler) http.Handler {\r\n\treturn http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\r\n\t\tw.Header().Set(\"X-Lab-Handler\", name)\r\n\t\tnext.ServeHTTP(w, r)\r\n\t})\r\n}\r\n\r\nfunc tenantData(w http.ResponseWriter, r *http.Request) {\r\n\ttenant := r.PathValue(\"tenant\")\r\n\tchiTenant := chi.URLParam(r, \"tenant\")\r\n\tif tenant == \"\" {\r\n\t\ttenant = \"public\"\r\n\t}\r\n\tif chiTenant == \"\" {\r\n\t\tchiTenant = \"public\"\r\n\t}\r\n\t_, _ = fmt.Fprintf(w, \"synthetic resource: tenant=%s chi-url-param=%s id=%s\\n\", tenant, chiTenant, r.PathValue(\"id\"))\r\n}\r\n\r\nfunc makeRouter(suppress bool) http.Handler {\r\n\troot := chi.NewRouter()\r\n\tif suppress {\r\n\t\troot.Use(middleware.SupressNotFound(root))\r\n\t}\r\n\r\n\troot.Route(\"/{tenant}\", func(mounted chi.Router) {\r\n\t\tmounted.Use(requireToken)\r\n\t\tmounted.Get(\"/data/{id}\", func(w http.ResponseWriter, r *http.Request) {\r\n\t\t\tservedBy(\"mounted-authenticated\", http.HandlerFunc(tenantData)).ServeHTTP(w, r)\r\n\t\t})\r\n\t})\r\n\troot.Get(\"/data/{id}\", func(w http.ResponseWriter, r *http.Request) {\r\n\t\tservedBy(\"root-public\", http.HandlerFunc(tenantData)).ServeHTTP(w, r)\r\n\t})\r\n\treturn root\r\n}\r\n\r\nfunc makeChildOnlyRouter(suppress bool) http.Handler {\r\n\troot := chi.NewRouter()\r\n\tif suppress {\r\n\t\troot.Use(middleware.SupressNotFound(root))\r\n\t}\r\n\troot.Route(\"/{tenant}\", func(mounted chi.Router) {\r\n\t\tmounted.Use(requireToken)\r\n\t\tmounted.Get(\"/settings\", func(w http.ResponseWriter, r *http.Request) {\r\n\t\t\tw.Header().Set(\"X-Lab-Handler\", \"mounted-authenticated-settings\")\r\n\t\t\t_, _ = fmt.Fprintf(w, \"synthetic settings: tenant=%s\\n\", r.PathValue(\"tenant\"))\r\n\t\t})\r\n\t})\r\n\treturn root\r\n}\r\n\r\nfunc request(h http.Handler, path, token string) {\r\n\treq := httptest.NewRequest(http.MethodGet, \"http://local.invalid\"+path, nil)\r\n\tif token != \"\" {\r\n\t\treq.Header.Set(\"Authorization\", \"Bearer \"+token)\r\n\t}\r\n\trec := httptest.NewRecorder()\r\n\th.ServeHTTP(rec, req)\r\n\tfmt.Printf(\"%s token=%t => %d served-by=%q body=%q\\n\", path, token != \"\", rec.Code, rec.Header().Get(\"X-Lab-Handler\"), rec.Body.String())\r\n}\r\n\r\nfunc main() {\r\n\tfmt.Println(\"without SupressNotFound:\")\r\n\th := makeRouter(false)\r\n\trequest(h, \"/acme/data/42\", \"\")\r\n\trequest(h, \"/acme/data/42\", \"local-test\")\r\n\trequest(h, \"/data/42\", \"\")\r\n\r\n\tfmt.Println(\"with SupressNotFound:\")\r\n\th = makeRouter(true)\r\n\trequest(h, \"/acme/data/42\", \"\")\r\n\trequest(h, \"/acme/data/42\", \"local-test\")\r\n\trequest(h, \"/data/42\", \"\")\r\n\r\n\tfmt.Println(\"mounted-only child path (no explicit root suffix handler):\")\r\n\th = makeChildOnlyRouter(false)\r\n\trequest(h, \"/acme/settings\", \"\")\r\n\trequest(h, \"/acme/settings\", \"local-test\")\r\n\th = makeChildOnlyRouter(true)\r\n\trequest(h, \"/acme/settings\", \"\")\r\n\trequest(h, \"/acme/settings\", \"local-test\")\r\n}\r\n```\r\n\r\nObserved output:\r\n\r\n```text\r\nwithout SupressNotFound:\r\n/acme/data/42 token=false => 401 served-by=\"\" body=\"auth required\\n\"\r\n/acme/data/42 token=true => 200 served-by=\"mounted-authenticated\" body=\"synthetic resource: tenant=acme chi-url-param=acme id=42\\n\"\r\n/data/42 token=false => 200 served-by=\"root-public\" body=\"synthetic resource: tenant=public chi-url-param=public id=42\\n\"\r\nwith SupressNotFound:\r\n/acme/data/42 token=false => 200 served-by=\"root-public\" body=\"synthetic resource: tenant=acme chi-url-param=acme id=42\\n\"\r\n/acme/data/42 token=true => 200 served-by=\"root-public\" body=\"synthetic resource: tenant=acme chi-url-param=acme id=42\\n\"\r\n/data/42 token=false => 200 served-by=\"root-public\" body=\"synthetic resource: tenant=public chi-url-param=public id=42\\n\"\r\nmounted-only child path (no explicit root suffix handler):\r\n/acme/settings token=false => 401 served-by=\"\" body=\"auth required\\n\"\r\n/acme/settings token=true => 200 served-by=\"mounted-authenticated-settings\" body=\"synthetic settings: tenant=acme\\n\"\r\n/acme/settings token=false => 401 served-by=\"\" body=\"auth required\\n\"\r\n/acme/settings token=true => 404 served-by=\"\" body=\"404 page not found\\n\"\r\n```\r\n\r\n\r\n\r\n### Impact\r\n\r\n## Impact and prerequisites\r\n\r\nThe wider functional effect is that preflight matching can disrupt mounted requests. In the mounted-only control, chi still has the parameterized outer mount route created by `Route(\"/{tenant}\")`, but there is no separate root-level `GET /settings` handler. The authenticated `/acme/settings` request reaches the child endpoint and returns 200 without `SupressNotFound`; with it, the same request returns 404. The security impact demonstrated here is narrower: in the route-collision topology, an unauthenticated client reaches an outer public handler through a mounted path and selects tenant-scoped data using the retained mount parameter, skipping authentication attached to the mounted router. In a deployed application this may disclose another tenant's resources if a public outer route reuses a tenant-aware handler and trusts the mount parameter as a tenant selector.\r\n\r\nConditions in the exact reproduction:\r\n\r\n1. `SupressNotFound` is installed on the outer router used by the tested request path.\r\n2. A mounted child route applies authentication or authorization middleware.\r\n3. For the same method, the child route matches the suffix after the mount so the preflight succeeds, and the outer router also has a public route for that suffix. The mounted-only control has no explicit root-level suffix handler and shows a different failure mode: a valid request returns 404 rather than reaching the child endpoint.\r\n4. The outer route uses a handler that reads the mount parameter (here `tenant`; the harness demonstrates both `Request.PathValue` and `chi.URLParam`) to select tenant scope.\r\n5. That shared handler trusts the parameter without enforcing authorization itself, and no common ancestor enforces the authorization required by the mounted route.\r\n\r\nThis is conditional on application topology; it is not a universal bypass of mounted authentication. The two reproductions show different outcomes: a mounted-only child path can return 404 even with valid credentials, while a suffix collision sends both authenticated and unauthenticated callers to the outer public handler. The latter is the security-relevant case. Realistic exposure further depends on a shared handler that does not rely on identity state established by the mounted middleware. The reproduction demonstrates the behavior with synthetic data, but does not establish how commonly applications use this topology or the sensitivity of affected resources. The implementation is present in the older tagged source snapshots listed above, but exact runtime behavior was tested only on v5.4.0; no fixed release is known. Suggested package-level severity is Low because the security impact depends on a specific route collision and authentication placement; impact in an affected deployment may be substantial.\r\n\r\n## Suggested fix\r\n\r\nUse a fresh route context for the preflight match, following the Match documentation's recommendation to manage its mutated state or create a NewRouteContext. An application workaround is to remove SupressNotFound or enforce authorization in a common ancestor or the handler itself.\r\n\r\n## Public status\r\n\r\nI checked the public GitHub issue and pull-request tracker for the exact interaction between `SupressNotFound`, mounted `Route` handlers, and outer-router dispatch using the mutated suffix. I found no issue or pull request describing this behavior as of 2026-10-14. Nearby reports about child not-found handler propagation or route-pattern composition describe different behavior; this search was focused and is not exhaustive.","summary":"The chi router's SupressNotFound middleware mutates shared route state while matching, so a request meant for an authenticated mounted router can be dispatched to an outer public route. If that public route reuses a tenant-aware handler and trusts the mount parameter, an unauthenticated caller can read another tenant's data.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/go-chi/chi/v5","note":"<=5.4.0","fixed":["5.5.0"],"affected":"<= 5.4.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["chi","go","multi-tenant","package","self-hosted"],"not_affected_if":["no-suffix-collision","no-supressnotfound","outer-route-enforces-auth","version-5.5.0-or-later"],"how_to_check":"- Check the go-chi/chi/v5 version in `go.mod`; affected versions are `<= 5.4.0`.\n- Search the code for `middleware.SupressNotFound`.\n- Look for an outer public route whose path matches a suffix of a mounted `Route(\"/{tenant}\", ...)` route that uses auth middleware, and whether that handler reads the tenant parameter.","fix":"- go-chi/chi/v5: `5.5.0`","status":"open","published_at":"2026-10-14T13:24:10+00:00","first_seen_at":"2026-11-09T22:53:32+00:00","triaged_at":"2026-11-09T22:58:57+00:00","updated_at":"2026-11-09T22:58:57+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T22:58:57Z","model":"claude-haiku-5-5","output":{"fix":"- go-chi/chi/v5: `5.5.0`","reach":"internet","title":"chi: SupressNotFound middleware lets mounted requests reach a public handler","impact":"medium","summary":"The chi router's SupressNotFound middleware mutates shared route state while matching, so a request meant for an authenticated mounted router can be dispatched to an outer public route. If that public route reuses a tenant-aware handler and trusts the mount parameter, an unauthenticated caller can read another tenant's data.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","chi","self-hosted","multi-tenant"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated caller reads another tenant's data through a public route","analyst_note":"","how_to_check":"- Check the go-chi/chi/v5 version in `go.mod`; affected versions are `<= 5.4.0`.\n- Search the code for `middleware.SupressNotFound`.\n- Look for an outer public route whose path matches a suffix of a mounted `Route(\"/{tenant}\", ...)` route that uses auth middleware, and whether that handler reads the tenant parameter.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-supressnotfound","version-5.5.0-or-later","no-suffix-collision","outer-route-enforces-auth"],"who_is_affected":"Only applications that use chi v5 with the SupressNotFound middleware, mount a child router behind authentication, and also expose a public outer route with the same suffix that reuses a handler trusting the mount parameter. Applications without SupressNotFound or without this route collision are not shown to be affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.001241,"input_tokens":9200,"output_tokens":642,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-130':520C '-20':517C '-24':448C '-285':479C '-382':460C '-398':469C '-405':490C '-491':498C '/acme/data/42':323C,354C '/acme/settings':226C '/chi':118C,441C '/data/42':337C '/go-chi/chi/v5':31A '/go-chi/chi/v5.0.12/middleware/supress_notfound.go),':557C '/go-chi/chi/v5.1.0/middleware/supress_notfound.go),':562C '/go-chi/chi/v5.2.0/middleware/supress_notfound.go),':567C '/go-chi/chi/v5.3.0/middleware/supress_notfound.go).':572C '/settings':220C '122':519C '18':447C '401':326C '404':237C '5958':23A,28A '7f9b7448f51d28804fac98c0a17bc2a7cec1079f':445C '8cg2':22A,27A 'acm':367C,377C 'affect':431C,586C,594C 'allow':6A,100C 'also':177C 'anoth':90B 'api':383C 'append':491C 'appli':310C 'applic':403C 'around':287C 'authent':59B,198C,225C,311C,328C,352C 'author':424C 'awar':78B,292C,408C 'broader':241C 'build':601C 'call':121C,453C,507C 'caller':87B 'chain':286C 'chang':167C,470C 'check':580C 'chi':32B,42B,117C,440C 'chi.urlparam':372C,387C,523C 'child':158C,196C,229C 'co':621C 'collis':139C,257C 'commit':444C 'comparison':538C 'concept':610C 'configur':140C 'confirm':386C 'context':128C,135C,394C,467C,533C 'context.go:10':516C 'continu':456C 'control':207C 'creat':278C,483C 'data':93B,301C,319C,617C 'demonstr':249C,397C 'deni':325C 'depend':400C 'descend':144C,473C 'detail':430C 'direct':335C 'disclosur':398C 'dispatch':64B,164C,458C,499C 'distinct':284C 'document':131C,461C 'empti':504C 'enabl':344C 'endpoint':221C 'enforc':423C 'evid':603C 'exact':272C,600C 'exact-build':599C 'exact-vers':271C 'exist':306C 'explicit':217C 'failur':245C 'first':593C 'fix':597C 'found':539C 'generat':210C 'get':219C,322C,336C,353C 'ghsa':20A,25A 'ghsa-rqrp-8cg2':19A,24A 'github.com':30A 'github.com/go-chi/chi/v5':29A 'go':33B,116C,439C 'go-chi':115C,438C 'handl':356C 'handler':15A,79B,109C,186C,230C,262C,293C,316C,333C,409C 'har':380C 'histor':534C 'host':40B 'httptest':613C 'identifi':591C 'impact':248C,429C 'implement':543C 'independ':422C 'inspect':385C 'instead':188C 'leav':149C 'librari':510C 'live':125C,451C 'local':270C 'match':52B,122C,129C,143C,454C,492C 'match/find':463C 'meant':56B 'middlewar':46B,199C,224C 'middleware.supressnotfound':120C 'middleware/supress_notfound.go':446C 'mount':8A,60B,83B,102C,147C,151C,191C,195C,205C,213C,243C,267C,280C,308C,332C,476C,487C 'mounted-on':204C 'mounted-rout':242C 'multi':35B,584C 'multi-releas':583C 'multi-ten':34B 'mutabl':3A,97C 'mutat':47B,133C 'mux.go:276':478C 'mux.go:367':459C 'mux.go:397':468C 'mux.go:459':497C 'narrow':252C 'non':503C 'non-empti':502C 'normal':320C,457C 'observ':381C 'older':574C 'otherwis':416C 'outer':13A,67B,107C,171C,175C,211C,260C,295C,347C,359C,412C,419C 'packag':37B 'paramet':84B,152C,212C,268C,305C,368C,395C,494C 'path':168C,435C 'preflight':142C 'program':614C 'proof':608C 'public':14A,68B,72B,108C,180C,261C,299C,341C,360C,417C 'public-scop':298C 'rang':587C 'raw.githubusercontent.com':556C,561C,566C,571C 'raw.githubusercontent.com/go-chi/chi/v5.0.12/middleware/supress_notfound.go),':555C 'raw.githubusercontent.com/go-chi/chi/v5.1.0/middleware/supress_notfound.go),':560C 'raw.githubusercontent.com/go-chi/chi/v5.2.0/middleware/supress_notfound.go),':565C 'raw.githubusercontent.com/go-chi/chi/v5.3.0/middleware/supress_notfound.go).':570C 'reach':11A,105C,227C,330C 'read':89B,388C,524C 'receiv':363C 'releas':585C,598C 'reproduct':274C,611C 'request':9A,55B,103C,126C,235C,329C,531C 'request.pathvalue':370C 'request.setpathvalue':512C 'requir':254C 'resourc':378C 'retain':266C,365C,391C,514C,527C 'retriev':449C 'return':236C,338C,374C 'reus':2A,74B,96C,404C 'root':218C 'rout':4A,49B,69B,73B,98C,127C,181C,192C,244C,285C,296C,309C,361C,393C,413C,420C,493C,532C 'routecontext':452C 'routepath':161C,471C,505C 'router':43B,61B,148C,172C,176C,348C,477C 'router.route':276C,482C 'routing-context':392C 'rqrp':21A,26A 'run':187C,578C 'runtim':602C 'scope':18A,112C,300C 'secur':247C 'self':39B 'self-host':38B 'separ':203C 'serv':297C 'set':156C 'share':48B,289C 'show':239C,480C,521C 'skip':201C 'sourc':384C,434C,536C,554C,559C,564C,569C 'source-on':535C 'standard':509C 'state':5A,50B,99C 'subrout':282C,485C 'subsequ':163C 'suffix':159C,184C,256C 'suggest':581C 'summari':94C,113C 'suppli':466C 'supressnotfound':1A,45B,95C,343C,542C 'synthet':376C,616C 'tag':443C 'tenant':17A,36B,77B,91B,111C,214C,291C,304C,318C,340C,366C,407C 'tenant-awar':76B,290C,406C 'test':138C,551C 'therefor':399C 'tree.go:383':489C 'trust':81B,264C 'unauthent':86B,321C,350C 'updat':464C 'urlparam':154C,496C,515C,528C 'use':165C,275C,313C,500C,615C 'v5.0.12':545C,553C 'v5.1.0':546C,558C 'v5.2.0':547C,563C 'v5.3.0':548C,568C 'v5.4.0':119C,442C,552C,607C 'verifi':436C 'version':273C,432C,437C,575C 'without':222C 'would':425C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use chi v5 with the SupressNotFound middleware, mount a child router behind authentication, and also expose a public outer route with the same suffix that reuses a handler trusting the mount parameter. Applications without SupressNotFound or without this route collision are not shown to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["githubcomgochichiv5"],"ptokens":["chi","com","github","go","v5"],"labels":["chi","go","low","multitenant","package","selfhosted"],"campaign_type":null,"search_a":"'/go-chi/chi/v5':31A '5958':23A,28A '8cg2':22A,27A 'allow':6A 'ghsa':20A,25A 'ghsa-rqrp-8cg2':19A,24A 'github.com':30A 'github.com/go-chi/chi/v5':29A 'handler':15A 'mount':8A 'mutabl':3A 'outer':13A 'public':14A 'reach':11A 'request':9A 'reus':2A 'rout':4A 'rqrp':21A,26A 'scope':18A 'state':5A 'supressnotfound':1A 'tenant':17A","search_b":"'anoth':90B 'authent':59B 'awar':78B 'caller':87B 'chi':32B,42B 'data':93B 'dispatch':64B 'go':33B 'handler':79B 'host':40B 'match':52B 'meant':56B 'middlewar':46B 'mount':60B,83B 'multi':35B 'multi-ten':34B 'mutat':47B 'outer':67B 'packag':37B 'paramet':84B 'public':68B,72B 'read':89B 'request':55B 'reus':74B 'rout':49B,69B,73B 'router':43B,61B 'self':39B 'self-host':38B 'share':48B 'state':50B 'supressnotfound':45B 'tenant':36B,77B,91B 'tenant-awar':76B 'trust':81B 'unauthent':86B","search_c":"'-130':520C '-20':517C '-24':448C '-285':479C '-382':460C '-398':469C '-405':490C '-491':498C '/acme/data/42':323C,354C '/acme/settings':226C '/chi':118C,441C '/data/42':337C '/go-chi/chi/v5.0.12/middleware/supress_notfound.go),':557C '/go-chi/chi/v5.1.0/middleware/supress_notfound.go),':562C '/go-chi/chi/v5.2.0/middleware/supress_notfound.go),':567C '/go-chi/chi/v5.3.0/middleware/supress_notfound.go).':572C '/settings':220C '122':519C '18':447C '401':326C '404':237C '7f9b7448f51d28804fac98c0a17bc2a7cec1079f':445C 'acm':367C,377C 'affect':431C,586C,594C 'allow':100C 'also':177C 'api':383C 'append':491C 'appli':310C 'applic':403C 'around':287C 'authent':198C,225C,311C,328C,352C 'author':424C 'awar':292C,408C 'broader':241C 'build':601C 'call':121C,453C,507C 'chain':286C 'chang':167C,470C 'check':580C 'chi':117C,440C 'chi.urlparam':372C,387C,523C 'child':158C,196C,229C 'co':621C 'collis':139C,257C 'commit':444C 'comparison':538C 'concept':610C 'configur':140C 'confirm':386C 'context':128C,135C,394C,467C,533C 'context.go:10':516C 'continu':456C 'control':207C 'creat':278C,483C 'data':301C,319C,617C 'demonstr':249C,397C 'deni':325C 'depend':400C 'descend':144C,473C 'detail':430C 'direct':335C 'disclosur':398C 'dispatch':164C,458C,499C 'distinct':284C 'document':131C,461C 'empti':504C 'enabl':344C 'endpoint':221C 'enforc':423C 'evid':603C 'exact':272C,600C 'exact-build':599C 'exact-vers':271C 'exist':306C 'explicit':217C 'failur':245C 'first':593C 'fix':597C 'found':539C 'generat':210C 'get':219C,322C,336C,353C 'go':116C,439C 'go-chi':115C,438C 'handl':356C 'handler':109C,186C,230C,262C,293C,316C,333C,409C 'har':380C 'histor':534C 'httptest':613C 'identifi':591C 'impact':248C,429C 'implement':543C 'independ':422C 'inspect':385C 'instead':188C 'leav':149C 'librari':510C 'live':125C,451C 'local':270C 'match':122C,129C,143C,454C,492C 'match/find':463C 'middlewar':199C,224C 'middleware.supressnotfound':120C 'middleware/supress_notfound.go':446C 'mount':102C,147C,151C,191C,195C,205C,213C,243C,267C,280C,308C,332C,476C,487C 'mounted-on':204C 'mounted-rout':242C 'multi':584C 'multi-releas':583C 'mutabl':97C 'mutat':133C 'mux.go:276':478C 'mux.go:367':459C 'mux.go:397':468C 'mux.go:459':497C 'narrow':252C 'non':503C 'non-empti':502C 'normal':320C,457C 'observ':381C 'older':574C 'otherwis':416C 'outer':107C,171C,175C,211C,260C,295C,347C,359C,412C,419C 'paramet':152C,212C,268C,305C,368C,395C,494C 'path':168C,435C 'preflight':142C 'program':614C 'proof':608C 'public':108C,180C,261C,299C,341C,360C,417C 'public-scop':298C 'rang':587C 'raw.githubusercontent.com':556C,561C,566C,571C 'raw.githubusercontent.com/go-chi/chi/v5.0.12/middleware/supress_notfound.go),':555C 'raw.githubusercontent.com/go-chi/chi/v5.1.0/middleware/supress_notfound.go),':560C 'raw.githubusercontent.com/go-chi/chi/v5.2.0/middleware/supress_notfound.go),':565C 'raw.githubusercontent.com/go-chi/chi/v5.3.0/middleware/supress_notfound.go).':570C 'reach':105C,227C,330C 'read':388C,524C 'receiv':363C 'releas':585C,598C 'reproduct':274C,611C 'request':103C,126C,235C,329C,531C 'request.pathvalue':370C 'request.setpathvalue':512C 'requir':254C 'resourc':378C 'retain':266C,365C,391C,514C,527C 'retriev':449C 'return':236C,338C,374C 'reus':96C,404C 'root':218C 'rout':98C,127C,181C,192C,244C,285C,296C,309C,361C,393C,413C,420C,493C,532C 'routecontext':452C 'routepath':161C,471C,505C 'router':148C,172C,176C,348C,477C 'router.route':276C,482C 'routing-context':392C 'run':187C,578C 'runtim':602C 'scope':112C,300C 'secur':247C 'separ':203C 'serv':297C 'set':156C 'share':289C 'show':239C,480C,521C 'skip':201C 'sourc':384C,434C,536C,554C,559C,564C,569C 'source-on':535C 'standard':509C 'state':99C 'subrout':282C,485C 'subsequ':163C 'suffix':159C,184C,256C 'suggest':581C 'summari':94C,113C 'suppli':466C 'supressnotfound':95C,343C,542C 'synthet':376C,616C 'tag':443C 'tenant':111C,214C,291C,304C,318C,340C,366C,407C 'tenant-awar':290C,406C 'test':138C,551C 'therefor':399C 'tree.go:383':489C 'trust':264C 'unauthent':321C,350C 'updat':464C 'urlparam':154C,496C,515C,528C 'use':165C,275C,313C,500C,615C 'v5.0.12':545C,553C 'v5.1.0':546C,558C 'v5.2.0':547C,563C 'v5.3.0':548C,568C 'v5.4.0':119C,442C,552C,607C 'verifi':436C 'version':273C,432C,437C,575C 'without':222C 'would':425C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-14T13:24:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-rqrp-8cg2-5958","url":"https://github.com/go-chi/chi/security/advisories/GHSA-rqrp-8cg2-5958","severity":"low","published_at":"2026-10-14T13:24:10+00:00","modified_at":"2026-10-14T13:24:10+00:00","first_seen_at":"2026-11-09T22:53:32+00:00","fetched_at":"2026-11-09T22:53:32+00:00","note":null}],"documents":[{"id":48868,"url":"https://github.com/go-chi/chi/security/advisories/GHSA-rqrp-8cg2-5958","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-14T13:24:10+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}