Executive brief
The RealIP middleware in the chi Go router is used to identify the original client IP address when a web application is behind a proxy. A vulnerability allows attackers to spoof their IP address by providing a custom header, which can be used to bypass security restrictions like access control lists (ACLs) or rate limits. This could allow unauthorized access to administrative panels or cause incorrect data to be recorded in security logs.
Technical details
The `RealIP` middleware in `go-chi/chi` (specifically in `middleware/realip.go`) extracts the client IP by taking the first (leftmost) value from the `X-Forwarded-For` header. Because this header can be initialized or modified by the client before reaching the first proxy, the leftmost values are untrusted. An attacker can send a crafted header such as `X-Forwarded-For: <spoofed_ip>, <actual_proxy_ip>`, causing the middleware to return the spoofed IP as the request's source. This enables bypasses of IP-based authentication (CWE-290) and rate limiting. The vulnerability is addressed in version 5.3.0 by implementing a more secure IP extraction mechanism.
Affected products
- go-chi chi < 5.3.0
Timeline
- 2026-05-22: disclosed: Vulnerability reported to go-chi/chi
- 2026-06-25: advisory: GitHub Advisory published
- 2026-06-25: patched: Version 5.3.0 released