# github.com/labstack/echo/v4 (Go) vulnerabilities 21 known vulnerabilities (2 critical, 5 high, 10 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v4.16.3 (Oct 30, 2026): affected by 2 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 59 since v4.0.0 (Jan 30, 2019) - Registry: https://pkg.go.dev/github.com/labstack/echo/v4 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - GO-2026-6842: v4.0.0 to v4.16.0 (v4.16.1 is outside it) - GO-2026-6840: v4.0.0 to v4.16.0 (v4.16.1 is outside it) - GO-2026-6839: v4.0.0 to v4.16.0 (v4.16.1 is outside it) - GO-2026-6838: v4.15.0 to v4.16.0 (v4.16.1 is outside it) - CVE-2026-118658: v4.0.0 to v4.15.1 (v4.15.2 is outside it) - CVE-2026-118657: v4.0.0 to v4.15.4 (v4.16.0 is outside it) - CVE-2026-118656: v4.0.0 to v4.15.4 (v4.16.0 is outside it) - CVE-2026-118655: v4.0.0 to v4.15.2 (v4.15.3 is outside it) - CVE-2026-118654: v4.0.0 to v4.15.4 (v4.16.0 is outside it) - CVE-2026-118653: v4.0.0 to v4.16.3 (through the newest release) - CVE-2026-118652: v4.0.0 to v4.15.4 (v4.16.0 is outside it) - CVE-2026-118651: v4.0.0 to v4.16.3 (through the newest release) - CVE-2026-118650: v4.0.0 to v4.15.4 (v4.16.0 is outside it) - CVE-2026-118266: v4.0.0 to v4.15.4 (v4.16.0 is outside it) - CVE-2026-118264: v4.0.0 to v4.16.0 (v4.16.1 is outside it) - CVE-2026-118262: v4.15.0 to v4.16.0 (v4.16.1 is outside it) - CVE-2026-118261: v4.0.0 to v4.16.0 (v4.16.1 is outside it) - CVE-2026-118260: v4.0.0 to v4.16.0 (v4.16.1 is outside it) - CVE-2026-55677: v4.0.0 to v4.15.2 (v4.15.3 is outside it) - CVE-2020-36565: v4.0.0 to v4.1.17 (v4.2.0 is outside it) - CVE-2022-40083: v4.0.0 to v4.8.0 (v4.9.0 is outside it) ## Advisories (21) ### [GO-2026-6842](https://cve.now/GO-2026-6842): Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo - Severity: Unrated - Published: Nov 5, 2026 - Affected: from 4.0.0, fixed in 4.16.1. - Fixed in v4.16.1 (released Oct 22, 2026, 14 days before disclosure). - The latest release, v4.16.3, is not affected. ### [GO-2026-6840](https://cve.now/GO-2026-6840): Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo - Severity: Unrated - Published: Nov 5, 2026 - Affected: from 4.0.0, fixed in 4.16.1. - Fixed in v4.16.1 (released Oct 22, 2026, 14 days before disclosure). - The latest release, v4.16.3, is not affected. ### [GO-2026-6839](https://cve.now/GO-2026-6839): Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo - Severity: Unrated - Published: Nov 5, 2026 - Affected: from 4.0.0, fixed in 4.16.1. - Fixed in v4.16.1 (released Oct 22, 2026, 14 days before disclosure). - The latest release, v4.16.3, is not affected. ### [GO-2026-6838](https://cve.now/GO-2026-6838): Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo - Severity: Unrated - Published: Nov 5, 2026 - Affected: from 4.15.0, fixed in 4.16.1. - Fixed in v4.16.1 (released Oct 22, 2026, 14 days before disclosure). - The latest release, v4.16.3, is not affected. ### [CVE-2026-118658](https://cve.now/CVE-2026-118658): Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto - Severity: Medium 4.7 - Published: Oct 28, 2026 - Affected: fixed in 4.15.2. - Fixed in v4.15.2 (released May 1, 2026, 180 days before disclosure). - The latest release, v4.16.3, is not affected. ### [CVE-2026-118657](https://cve.now/CVE-2026-118657): Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers - Severity: Medium 5.9 - Published: Oct 28, 2026 - Affected: fixed in 4.16.0. - Fixed in v4.16.0 (released Sep 27, 2026, 31 days before disclosure). - The latest release, v4.16.3, is not affected. ### [CVE-2026-118656](https://cve.now/CVE-2026-118656): Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI - Severity: Medium 6.1 - Published: Oct 28, 2026 - Affected: fixed in 4.16.0. - Fixed in v4.16.0 (released Sep 27, 2026, 31 days before disclosure). - The latest release, v4.16.3, is not affected. ### [CVE-2026-118655](https://cve.now/CVE-2026-118655): Echo: Static Middleware Double-Unescape Path Traversal - Severity: Medium 5.9 - Published: Oct 28, 2026 - Affected: fixed in 4.15.3. - Fixed in v4.15.3 (released Jun 14, 2026, 136 days before disclosure). - The latest release, v4.16.3, is not affected. ### [CVE-2026-118654](https://cve.now/CVE-2026-118654): Echo static file middleware route protection bypass via encoded dot-dot traversal - Severity: Medium 5.9 - Published: Oct 28, 2026 - Affected: fixed in 4.16.0. - Fixed in v4.16.0 (released Sep 27, 2026, 31 days before disclosure). - The latest release, v4.16.3, is not affected. ### [CVE-2026-118653](https://cve.now/CVE-2026-118653): Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration - Severity: Medium 5.3 - Published: Oct 28, 2026 - Affected: from 4.0.0, through 4.16.2; from 4.0.0. - No fix released. The latest release, v4.16.3, is still affected. ### [CVE-2026-118652](https://cve.now/CVE-2026-118652): Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob - Severity: Medium 6.1 - Published: Oct 28, 2026 - Affected: fixed in 4.16.0. - Fixed in v4.16.0 (released Sep 27, 2026, 31 days before disclosure). - The latest release, v4.16.3, is not affected. ### [CVE-2026-118651](https://cve.now/CVE-2026-118651): Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default - Severity: Medium 5.3 - Published: Oct 28, 2026 - Affected: from 4.0.0, through 4.16.2; from 4.0.0. - No fix released. The latest release, v4.16.3, is still affected. ### [CVE-2026-118650](https://cve.now/CVE-2026-118650): Echo: middleware.Static: \`%2F\`-encoded path bypasses route/group middleware guarding a statically-served path - Severity: High 7.5 - Published: Oct 28, 2026 - Affected: fixed in 4.16.0. - Fixed in v4.16.0 (released Sep 27, 2026, 31 days before disclosure). - The latest release, v4.16.3, is not affected. ### [CVE-2026-118266](https://cve.now/CVE-2026-118266): Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method - Severity: Medium 5.3 - Published: Oct 28, 2026 - Affected: fixed in 4.16.0. - Fixed in v4.16.0 (released Sep 27, 2026, 31 days before disclosure). - The latest release, v4.16.3, is not affected. ### [CVE-2026-118264](https://cve.now/CVE-2026-118264): Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls - Severity: Critical 9.1 - Published: Oct 28, 2026 - Affected: from 4.0.0, fixed in 4.16.1. - Fixed in v4.16.1 (released Oct 22, 2026, 6 days before disclosure). - The latest release, v4.16.3, is not affected. ### [CVE-2026-118262](https://cve.now/CVE-2026-118262): Echo: WebSocket proxy can retain connections and handlers after client disconnect - Severity: High 8.2 - Published: Oct 28, 2026 - Affected: from 4.15.0, fixed in 4.16.1. - Fixed in v4.16.1 (released Oct 22, 2026, 6 days before disclosure). - The latest release, v4.16.3, is not affected. ### [CVE-2026-118261](https://cve.now/CVE-2026-118261): Echo: Decompress permits unbounded gzip expansion in v4 - Severity: High 8.2 - Published: Oct 28, 2026 - Affected: from 4.0.0, fixed in 4.16.1. - Fixed in v4.16.1 (released Oct 22, 2026, 6 days before disclosure). - The latest release, v4.16.3, is not affected. ### [CVE-2026-118260](https://cve.now/CVE-2026-118260): Echo: BodyDump captures request and response bodies without size limits in v4 - Severity: High 8.2 - Published: Oct 28, 2026 - Affected: from 4.0.0, fixed in 4.16.1. - Fixed in v4.16.1 (released Oct 22, 2026, 6 days before disclosure). - The latest release, v4.16.3, is not affected. ### [CVE-2026-55677](https://cve.now/CVE-2026-55677): Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files - Severity: High 7.5 - Published: Jun 26, 2026 - Affected: fixed in 4.15.3. - Fixed in v4.15.3 (released Jun 14, 2026, 12 days before disclosure). - The latest release, v4.16.3, is not affected. ### [CVE-2020-36565](https://cve.now/CVE-2020-36565): Directory traversal on Windows in github.com/labstack/echo/v4 - Severity: Medium 5.3 - Published: Dec 7, 2022 - Affected: fixed in 4.1.18-0.20201215153152-4422e3b66b9f; fixed in 4.2.0; fixed in 4.1.18-0.20201215153152-4422e3b66b9f. - Fixed in v4.2.0 (released Feb 11, 2021, 664 days before disclosure). - The latest release, v4.16.3, is not affected. ### [CVE-2022-40083](https://cve.now/CVE-2022-40083): Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. - Severity: Critical 9.6 - Published: Sep 28, 2022 - Affected: fixed in 4.9.0. - Fixed in v4.9.0 (released Sep 4, 2022, 24 days before disclosure). - The latest release, v4.16.3, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/labstack/echo/v4 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.