# go-chi chi open redirect in RedirectSlashes middleware

Source: https://junglewise.ai/threats/go-chi-chi-open-redirect-in-redirectslashes-middleware-700b7eff  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-19. Updated: 2026-06-18  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 4.7 · Published 2026-02-19

A vulnerability in the chi web router library could allow attackers to redirect users from a legitimate website to a malicious one. This occurs when the application processes URLs with specific trailing slash patterns. Attackers can use this to facilitate phishing campaigns by making malicious links appear to belong to a trusted domain.

Technologies: [github.com/go-chi/chi/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-go-chi-chi-v5), [Go-Chi Chi](https://junglewise.ai/threats/technologies/chi). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Go-Chi](https://junglewise.ai/threats/vendors/go-chi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 4.7, published 19 February 2026.

**Which products and versions are affected?** github.com/go-chi/chi/v5 (Go) >= 5.2.2, < 5.2.4; Go-Chi Chi >= 5.2.2, < 5.2.4.

**Is there a fix for This vulnerability?** A patch was published on 2026-06-18: Advisory updated with patch information and withdrawn as duplicate of GHSA-mqqf-5wvp-8fh8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run github.com/go-chi/chi/v5 (Go) or Go-Chi Chi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An open redirect vulnerability (CWE-601) exists in the RedirectSlashes middleware of the go-chi/chi library. The root cause is improper validation of user-supplied input within the RedirectSlashes function, which can be manipulated to point to an external domain. A remote, unauthenticated attacker can exploit this by crafting a specific URL that, when processed by the middleware, triggers a redirect to an arbitrary untrusted site. This requires user interaction (clicking a link). The issue is fixed in version 5.2.4.

## Affected products

- go-chi chi >= 5.2.2, < 5.2.4

## Timeline

- 2026-02-19: disclosed
- 2026-02-19: advisory
- 2026-06-18: patched: Advisory updated with patch information and withdrawn as duplicate of GHSA-mqqf-5wvp-8fh8

## References

- [https://api.github.com/users/OddBloke](https://api.github.com/users/OddBloke)
- [https://github.com/OddBloke](https://github.com/OddBloke)
- [https://api.github.com/users/OddBloke/gists%7B/gist_id%7D](https://api.github.com/users/OddBloke/gists%7B/gist_id%7D)
- [https://api.github.com/users/OddBloke/repos](https://api.github.com/users/OddBloke/repos)
- [https://avatars.githubusercontent.com/u/62736?v=4](https://avatars.githubusercontent.com/u/62736?v=4)
- [https://api.github.com/users/OddBloke/events%7B/privacy%7D](https://api.github.com/users/OddBloke/events%7B/privacy%7D)

## Related threats

- [go-chi chi open redirect in RedirectSlashes middleware](https://junglewise.ai/threats/cve-2026-122132-go-chi-chi-5-2-2-through-5-5-0-contains-an-open-redirect)
- [Chi web framework client IP spoofing via X-Forwarded-For](https://junglewise.ai/threats/duplicate-advisory-chi-client-ip-spoofing-in-clientipfromxff-via-x-f73190e1)
- [Go Chi ClientIPFromXFF IP spoofing via X-Forwarded-For](https://junglewise.ai/threats/cve-2026-114437-in-the-golang-chi-web-framework-the-clientipfromxff-middleware)
- [GO-2026-5775 - Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi](https://junglewise.ai/threats/cve-2026-72817-chi-middleware-vulnerable-to-potential-ip-spoofing-via-x)
- [GO-2026-5777 - Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi](https://junglewise.ai/threats/cve-2026-72816-chi-s-realip-middleware-allows-ip-spoofing-via-unvalidated-x)