CVE-2025-71405: go-chi chi before v5.2.2 Open Redirect via RedirectSlashes

Severity: medium (CVSS 5.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-14 · updated 2026-10-08
Weakness: CWE-601

Description

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft.

Affected products

go-chi chi: before 5.2.2 — fixed in 5.2.2

How to fix

Upgrade to a fixed version: go-chi chi 5.2.2. Check the vendor advisory for mitigations.

References

https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93
https://www.vulncheck.com/advisories/go-chi-chi-before-open-redirect-via-redirectslashes
https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93

Get alerted when CVE-2025-71405 or the next vulnerability affects your stack