GHSA-3fxj-6jh8-hvhx: chi Has an IP Spoofing Vulnerability in `middleware.RealIP`

June 25, 2026 (updated November 4, 2026)

The RealIP middleware in go-chi/chi is vulnerable to IP spoofing because it blindly trusts the first (leftmost) element of the X-Forwarded-For HTTP header. This allows a remote attacker to bypass IP-based access control lists (ACLs) and rate-limiting mechanisms by providing a spoofed IP address in the header.

References

github.com/advisories/GHSA-3fxj-6jh8-hvhx
github.com/go-chi/chi/commit/3b171578ca44dfd75ca3c5cbddc7b44c600a7b49
github.com/go-chi/chi/pull/967
github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx

Code Behaviors & Features

Detect and mitigate GHSA-3fxj-6jh8-hvhx with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →