CVE-2025-69725: go-chi chi open redirect in RedirectSlashes middleware

CVE-2025-69725 · Severity: medium · CVSS 4.7 · Published 2026-02-19

A security flaw exists in the go-chi library, a popular tool used by developers to build web applications in the Go programming language. The issue occurs in a component designed to clean up web addresses (URLs) by removing extra slashes. An attacker can use this flaw to create a deceptive link that appears to belong to a trusted website but instead redirects the user to a malicious site, potentially leading to phishing attacks or credential theft.

Technologies: github.com/go-chi/chi/v5 (Go), Go-Chi Chi. Vendors: Go, Go-Chi.

Quick answers

Is CVE-2025-69725 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-69725 being exploited in the wild.
How severe is CVE-2025-69725?
Medium severity, with a CVSS score of 4.7, published 19 February 2026.
Which products and versions are affected?
github.com/go-chi/chi (Go) SEMVER:introduced=0; github.com/go-chi/chi/v2 (Go) SEMVER:introduced=0; github.com/go-chi/chi/v3 (Go) SEMVER:introduced=0; github.com/go-chi/chi/v4 (Go) SEMVER:introduced=0; and 2 more.
Is there a fix for CVE-2025-69725?
Yes. github.com/go-chi/chi/v5 (Go): upgrade to 5.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-69725 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-69725?
Check whether you run github.com/go-chi/chi (Go), github.com/go-chi/chi/v2 (Go), github.com/go-chi/chi/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/go-chi/chi/v5 (Go): upgrade to 5.2.4 or later
    go get github.com/go-chi/chi/v5@v5.2.4

Technical details

An open redirect vulnerability exists in the RedirectSlashes function within middleware/strip.go of the go-chi/chi library. The function fails to validate or trim backslash (\) characters while processing path slashes, and since version 5.2.2, it does not include the Host header in redirect responses. An attacker can craft a URL starting with a backslash (e.g., '/\evil.com'), which many modern browsers (excluding Safari) interpret as a protocol-relative URL (//evil.com), resulting in a redirect to the attacker-controlled domain. This requires no authentication and is triggered when a victim clicks a malicious link. The issue is patched in version 5.2.4.

Affected products

  • go-chi chi >=5.2.2, <5.2.4

Identifiers

  • CVE-2025-69725
  • GHSA-mqqf-5wvp-8fh8
  • GO-2026-4316

Timeline

  • 2026-01-14: advisory: GitHub Security Advisory published by maintainers
  • 2026-02-19: disclosed: CVE published to NVD
  • 2026-01-14: patched: Fix released in version 5.2.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.