Open Redirect Vulnerability in chi Middleware by go-chi

CVE-2025-71405

What is CVE-2025-71405?

The chi web framework, prior to version 5.2.2, is susceptible to an open redirect vulnerability through its RedirectSlashes middleware function. This flaw arises when the middleware uses the Host header inappropriately to construct redirect URLs. By manipulating the Host header, attackers can redirect users to unauthorized external sites, potentially leading to phishing attacks and the theft of sensitive credentials. Users of chi are advised to update to version 5.2.2 or later to mitigate this issue.

References