GHSA-9g5q-2w5x-hmxf: chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution

June 25, 2026

The vulnerability allows the Request.RemoteAddr to be spoofed when determining the request source IP via the X-Forwarded-For header. This could result in misidentification of the request source and potentially compromise access control and logging integrity.

References

github.com/advisories/GHSA-9g5q-2w5x-hmxf
github.com/go-chi/chi/releases/tag/v5.3.0
github.com/go-chi/chi/security/advisories/GHSA-9g5q-2w5x-hmxf

Code Behaviors & Features

Detect and mitigate GHSA-9g5q-2w5x-hmxf with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →