CVE-2026-122132

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-122132
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-122132.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-122132
Aliases
Downstream
Published
2026-11-04T20:36:51Z
Modified
2026-11-07T02:34:25Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware
Details

go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301 Location header and resolve as a protocol-relative URL, bypassing the fix for CVE-2025-69725.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-601"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/122xxx/CVE-2026-122132.json"
}
References

Affected packages

Git / github.com/go-chi/chi

Affected ranges

Type
GIT
Repo
https://github.com/go-chi/chi
Events
Introduced
23c395f8524a30334126ca16fb4d37b88745b9b9
Last Affected
3a33ba578e0dd93444e0ff386cc26e665d92e31e
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "5.2.2"
                },
                {
                    "last_affected": "5.5.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "5.2.2"
                },
                {
                    "last_affected": "5.5.0"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

v5.*
v5.2.2
v5.2.3
v5.2.4
v5.2.5
v5.3.0
v5.3.1
v5.3.2
v5.4.0
v5.5.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-122132.json"