GHSA-rjr7-jggh-pgcp: chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header

June 25, 2026

realip middleware in go-chi/chi trusts headers like x-forwarded-for without checking them, so attackers can fake their ip and bypass rate limits or access controls

References

github.com/advisories/GHSA-rjr7-jggh-pgcp
github.com/go-chi/chi/releases/tag/v5.3.0
github.com/go-chi/chi/security/advisories/GHSA-rjr7-jggh-pgcp

Code Behaviors & Features

Detect and mitigate GHSA-rjr7-jggh-pgcp with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →