CVE-2026-122132
Last modified
CVE-2026-122132 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301 Location header and resolve as a protocol-relative URL, bypassing the fix for CVE-2025-69725.. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301 Location header and resolve as a protocol-relative URL, bypassing the fix for CVE-2025-69725.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-122132?
How severe is CVE-2026-122132?
How do I fix CVE-2026-122132?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-122126reSIProcate reTurn client through 1.14.0 contains a heap buf…5.9
- CVE-2026-122127CESNET ipfixcol2 2.7.1 before 2.9.0 contains a heap-based bu…7.5
- CVE-2026-122129CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory alloca…5.3
- CVE-2026-12213A vulnerability was found in hcengineering Huly Platform up …4.3
- CVE-2026-122130CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer over…8.2
- CVE-2026-122131Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains…3.7
- CVE-2026-122133Mistral Vibe before 2.25.5 on Windows contains an untrusted …8.8
- CVE-2026-122134Mistral Vibe before 2.25.7 contains a remote code execution …8.8
- CVE-2026-122135Mistral Vibe before 3.0.3 contains a remote code execution v…8.8
- CVE-2026-122136Powerlevel10k before 1.20.19 contains a symlink following vu…4.4
- CVE-2026-122137Powerlevel10k before 1.20.19 contains an insecure temporary …6.7
- CVE-2026-122138BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains …5.3
Are you affected by CVE-2026-122132?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST