go-chi has 11 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 9 in the last 90 days against 0 in the 90 before. The busiest recent month was June 2026 with 4. The median CVSS is 6.5 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-290 (3). Most affected products: github.com/go-chi/chi/v5 (5), github.com/go-chi/chi/middleware (4), github.com/go-chi/chi/v5/middleware (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 9 prev 0
Products
- github.com/go-chi/chi/v5 5
- github.com/go-chi/chi/middleware 4
- github.com/go-chi/chi/v5/middleware 2
Worst active — by depth score
GHSA-rjr7-jggh-pgcpHighchi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header41GHSA-9g5q-2w5x-hmxfHighchi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution41CVE-2026-72815Mediumchi Has an IP Spoofing Vulnerability in `middleware.RealIP`40CVE-2026-72817Medium· 6.5go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted …36CVE-2026-72816Medium· 6.5go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go)36
go-chi vulnerabilities
CVEs affecting go-chi, newest first. Open any entry for full detail, references, and exploit status.
11 CVEsRSS
CVE-2026-72816Medium· 6.5go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go)
go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.Remot…
CVE-2026-72817Medium· 6.5go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted …
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted …
GO-2026-5777NoneChi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi
Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi
GO-2026-5775NoneChi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi
Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi
GO-2026-5774NoneChi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi
Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi
CVE-2026-72815MediumPoCchi Has an IP Spoofing Vulnerability in `middleware.RealIP`
chi Has an IP Spoofing Vulnerability in `middleware.RealIP`
GHSA-rjr7-jggh-pgcpHighchi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header
chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header
GHSA-9g5q-2w5x-hmxfHighchi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution
chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution
GHSA-3fxj-6jh8-hvhxMediumchi Has an IP Spoofing Vulnerability in `middleware.RealIP`
chi Has an IP Spoofing Vulnerability in `middleware.RealIP`
CVE-2025-69725Medium· 4.7chi has an open redirect vulnerability in the RedirectSlashes middleware
chi has an open redirect vulnerability in the RedirectSlashes middleware
CVE-2025-71405Mediumchi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes
chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes