go-chi chi open redirect in RedirectSlashes middleware

Executive brief

A vulnerability in the chi web router library could allow attackers to redirect users from a legitimate website to a malicious one. This occurs when the application processes URLs with specific trailing slash patterns. Attackers can use this to facilitate phishing campaigns by making malicious links appear to belong to a trusted domain.

Technical details

An open redirect vulnerability (CWE-601) exists in the RedirectSlashes middleware of the go-chi/chi library. The root cause is improper validation of user-supplied input within the RedirectSlashes function, which can be manipulated to point to an external domain. A remote, unauthenticated attacker can exploit this by crafting a specific URL that, when processed by the middleware, triggers a redirect to an arbitrary untrusted site. This requires user interaction (clicking a link). The issue is fixed in version 5.2.4.

Affected products

• go-chi chi >= 5.2.2, < 5.2.4

Timeline

• 2026-02-19: disclosed
• 2026-02-19: advisory
• 2026-06-18: patched: Advisory updated with patch information and withdrawn as duplicate of GHSA-mqqf-5wvp-8fh8

References

• https://api.github.com/users/OddBloke
• https://github.com/OddBloke
• https://api.github.com/users/OddBloke/gists%7B/gist_id%7D
• https://api.github.com/users/OddBloke/repos
• https://avatars.githubusercontent.com/u/62736?v=4
• https://api.github.com/users/OddBloke/events%7B/privacy%7D