CVE-2026-114437

Name of the Vulnerable Software and Affected Versions chi versions prior to 5.4.0

Description The ClientIPFromXFF middleware in the Golang Chi web framework fails to verify if the direct TCP peer in http.Request.RemoteAddr belongs to the configured trusted CIDR. While the middleware skips X-Forwarded-For entries within a trusted CIDR, the lack of peer verification allows a client with direct access to the server to append a spoofed proxy address. This enables the client to manipulate the IP address returned by the GetClientIP() function.

Recommendations Update chi to version 5.4.0 or later.