CVE-2026-122132 in chi
Summary
by MITRE • 11/04/2026
go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301 Location header and resolve as a protocol-relative URL, bypassing the fix for CVE-2025-69725.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in go-chi versions 5.2.2 through 5.5.0 represents a significant security flaw within the RedirectSlashes middleware component of this popular Go web router framework. This issue specifically targets the logic used to handle URL normalization and redirection when trailing slashes are present or missing in request paths. The core technical failure lies in how the middleware processes special characters, particularly tab characters encoded as percent-encoded sequences such as %09 within the requested URI path. When an attacker crafts a malicious link containing these embedded control characters, they exploit a discrepancy between server-side parsing and browser-side rendering behaviors to bypass existing security controls.
The operational mechanism of this attack relies on the interaction between the HTTP redirect response headers and modern web browsers. Upon receiving a request with a tab character in the path, the go-chi middleware generates an HTTP 301 Moved Permanently response. The Location header within this response contains the target URL intended for redirection. However, when a browser processes this 301 status code, it performs its own normalization of the redirect location before navigating to it. Browsers typically strip whitespace and control characters like tabs from URLs during parsing. This stripping action transforms what might have been an absolute or relative path into a protocol-relative URL if certain conditions are met, effectively allowing the attacker to dictate the destination domain without explicit scheme specification in the original request payload.
This behavior directly circumvents previous mitigations implemented for CVE-2025-69725, which likely attempted to restrict redirections to safe internal domains or prevent open redirects by validating URL structures more strictly on the server side. The vulnerability demonstrates that client-side normalization can undermine server-side validation if the two do not align perfectly in their interpretation of special characters. By leveraging this discrepancy, an attacker can redirect a victim user from a trusted application domain to a malicious external host. This is particularly dangerous because users often trust URLs originating from familiar domains, making them more susceptible to phishing attacks or drive-by downloads hosted on the redirected site.
From a classification perspective, this vulnerability aligns with CWE-601, which defines URL Redirection to Untrusted Site (Open Redirect). It also maps closely to MITRE ATT&CK technique T1583.002, specifically Domain Fronting or Open Redirect abuse for phishing and malware distribution. The impact extends beyond simple redirection; it can facilitate credential theft via spoofed login pages, session hijacking if cookies are accessible on the target domain, or exploitation of other vulnerabilities that rely on user interaction with trusted-looking links.
To mitigate this risk, developers utilizing go-chi versions 5.2.2 through 5.5.0 should upgrade to a patched version where the RedirectSlashes middleware has been updated to sanitize input more rigorously before generating redirect headers. Specifically, the fix must ensure that any control characters or whitespace are removed from URL paths prior to processing redirection logic. Additionally, implementing strict allow-lists for permitted redirect destinations can provide an additional layer of defense against open redirects regardless of encoding tricks. Security teams should also consider deploying Web Application Firewalls configured to detect and block requests containing unusual character sequences in URI paths that deviate from standard alphanumeric patterns.