CVE-2025-71405

The CVSS 5.1 score for CVE-2025-71405 significantly understates production risk. The vulnerability—RedirectSlashes in chi v5.2.2 trusting the Host header for redirect targets—appears low-severity in isolation, but chi applications almost never receive raw HTTP requests. In production, nginx, AWS ALB, Cloudflare, and other intermediaries pass Host headers through to the application unchanged, multiplying the injection surface. Each upstream proxy configuration determines whether the vulnerable code path is reachable. The more immediate concern is that RedirectSlashes is middleware your application likely inherits through boilerplate or framework defaults, not code you consciously deployed. Most developers cannot easily answer 'what middleware am I actually running?'—the Go ecosystem lacks tooling to audit effective middleware chains, unlike Node.js frameworks where composition is explicit and debuggable. This means you may be running vulnerable code without realizing RedirectSlashes is in your chain. For defenders: audit your middleware stack for RedirectSlashes specifically. Check what version of chi you're pulling and whether your upstream proxies mutate or pass through Host headers unchanged. If you're behind a proxy that rewrites Host to the backend's canonical hostname, you may be protected—but verify this don't assume it. The credential-theft scenario changes the risk calculus: a single vulnerable internal chi gateway serving as an authentication backend can enable convincing phishing against users who trust the internal service. The EPSS score of 0.00307 reflects opportunistic scanning, not targeted recon against internal infrastructure. Watch the long tail: this vulnerable pattern persists in templates and boilerplate long after patches ship. Your remediation window extends beyond patching to auditing every scaffolding tool and starter project that may have baked in the old chi version.

Reviewed through automated stages and approved by a human before publication.