IP Spoofing Vulnerability in go-chi/chi by ZURB

CVE-2026-72817

What is CVE-2026-72817?

The go-chi/chi middleware, versions 0.9.0 through 5.2.9, is susceptible to an IP spoofing vulnerability. Specifically, the RealIP middleware resolves the request source IP by trusts the first entry in the X-Forwarded-For header without proper validation of trusted proxies. This allows an attacker to prepend a fraudulent IP address to this header, potentially evading access controls and rendering request logs inaccurate. As a result, malicious actors can easily impersonate legitimate clients and exploit system vulnerabilities.

References