GHSA-9g5q-2w5x-hmxf: chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution

June 25, 2026

The vulnerability allows the Request.RemoteAddr to be spoofed when determining the request source IP via the X-Forwarded-For header. This could result in misidentification of the request source and potentially compromise access control and logging integrity.

References

github.com/advisories/GHSA-9g5q-2w5x-hmxf
github.com/go-chi/chi/releases/tag/v5.3.0
github.com/go-chi/chi/security/advisories/GHSA-9g5q-2w5x-hmxf

Code Behaviors & Features

Detect and mitigate GHSA-9g5q-2w5x-hmxf with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →