# github.com/labstack/echo/v5 (Go) vulnerabilities 19 known vulnerabilities (1 critical, 3 high, 12 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v5.4.4 (Oct 30, 2026): no advisory affects it - Newest unaffected release: v5.4.4 (Oct 30, 2026), the latest release - Releases: 16 since v5.0.0 (Jan 18, 2026) - Registry: https://pkg.go.dev/github.com/labstack/echo/v5 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - GO-2026-6841: v5.0.0 to v5.4.0 (v5.4.1 is outside it) - GO-2026-6839: v5.0.0 to v5.4.0 (v5.4.1 is outside it) - GO-2026-6838: v5.0.0 to v5.4.0 (v5.4.1 is outside it) - CVE-2026-118658: v5.0.0 to v5.1.0 (v5.1.1 is outside it) - CVE-2026-118657: v5.0.0 to v5.3.1 (v5.4.0 is outside it) - CVE-2026-118656: v5.0.0 to v5.3.1 (v5.4.0 is outside it) - CVE-2026-118655: v5.0.0 to v5.1.1 (v5.2.0 is outside it) - CVE-2026-118654: v5.0.0 to v5.3.1 (v5.4.0 is outside it) - CVE-2026-118653: v5.0.0 to v5.0.4 (v5.1.0 is outside it) - CVE-2026-118652: v5.0.0 to v5.3.1 (v5.4.0 is outside it) - CVE-2026-118651: v5.0.0 to v5.3.1 (v5.4.0 is outside it) - CVE-2026-118650: v5.0.0 to v5.3.1 (v5.4.0 is outside it) - CVE-2026-118266: v5.0.0 to v5.3.1 (v5.4.0 is outside it) - CVE-2026-118265: v5.0.0 to v5.4.0 (v5.4.1 is outside it) - CVE-2026-118264: v5.0.0 to v5.4.0 (v5.4.1 is outside it) - CVE-2026-118263: v5.0.0 to v5.4.0 (v5.4.1 is outside it) - CVE-2026-118262: v5.0.0 to v5.4.0 (v5.4.1 is outside it) - CVE-2026-55677: v5.0.0 to v5.1.1 (v5.2.0 is outside it) - CVE-2026-25766: v5.0.0 to v5.0.2 (v5.0.3 is outside it) ## Advisories (19) ### [GO-2026-6841](https://cve.now/GO-2026-6841): Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo - Severity: Unrated - Published: Nov 5, 2026 - Affected: from 5.0.0, fixed in 5.4.1. - Fixed in v5.4.1 (released Oct 22, 2026, 14 days before disclosure). - The latest release, v5.4.4, is not affected. ### [GO-2026-6839](https://cve.now/GO-2026-6839): Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo - Severity: Unrated - Published: Nov 5, 2026 - Affected: from 5.0.0, fixed in 5.4.1. - Fixed in v5.4.1 (released Oct 22, 2026, 14 days before disclosure). - The latest release, v5.4.4, is not affected. ### [GO-2026-6838](https://cve.now/GO-2026-6838): Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo - Severity: Unrated - Published: Nov 5, 2026 - Affected: from 5.0.0, fixed in 5.4.1. - Fixed in v5.4.1 (released Oct 22, 2026, 14 days before disclosure). - The latest release, v5.4.4, is not affected. ### [CVE-2026-118658](https://cve.now/CVE-2026-118658): Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto - Severity: Medium 4.7 - Published: Oct 28, 2026 - Affected: fixed in 5.1.1. - Fixed in v5.1.1 (released May 1, 2026, 180 days before disclosure). - The latest release, v5.4.4, is not affected. ### [CVE-2026-118657](https://cve.now/CVE-2026-118657): Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers - Severity: Medium 5.9 - Published: Oct 28, 2026 - Affected: fixed in 5.4.0. - Fixed in v5.4.0 (released Sep 27, 2026, 31 days before disclosure). - The latest release, v5.4.4, is not affected. ### [CVE-2026-118656](https://cve.now/CVE-2026-118656): Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI - Severity: Medium 6.1 - Published: Oct 28, 2026 - Affected: fixed in 5.4.0. - Fixed in v5.4.0 (released Sep 27, 2026, 31 days before disclosure). - The latest release, v5.4.4, is not affected. ### [CVE-2026-118655](https://cve.now/CVE-2026-118655): Echo: Static Middleware Double-Unescape Path Traversal - Severity: Medium 5.9 - Published: Oct 28, 2026 - Affected: fixed in 5.2.0. - Fixed in v5.2.0 (released Jun 14, 2026, 136 days before disclosure). - The latest release, v5.4.4, is not affected. ### [CVE-2026-118654](https://cve.now/CVE-2026-118654): Echo static file middleware route protection bypass via encoded dot-dot traversal - Severity: Medium 5.9 - Published: Oct 28, 2026 - Affected: fixed in 5.4.0. - Fixed in v5.4.0 (released Sep 27, 2026, 31 days before disclosure). - The latest release, v5.4.4, is not affected. ### [CVE-2026-118653](https://cve.now/CVE-2026-118653): Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration - Severity: Medium 5.3 - Published: Oct 28, 2026 - Affected: fixed in 5.1.0. - Fixed in v5.1.0 (released Mar 31, 2026, 211 days before disclosure). - The latest release, v5.4.4, is not affected. ### [CVE-2026-118652](https://cve.now/CVE-2026-118652): Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob - Severity: Medium 6.1 - Published: Oct 28, 2026 - Affected: fixed in 5.4.0. - Fixed in v5.4.0 (released Sep 27, 2026, 31 days before disclosure). - The latest release, v5.4.4, is not affected. ### [CVE-2026-118651](https://cve.now/CVE-2026-118651): Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default - Severity: Medium 5.3 - Published: Oct 28, 2026 - Affected: fixed in 5.4.0. - Fixed in v5.4.0 (released Sep 27, 2026, 31 days before disclosure). - The latest release, v5.4.4, is not affected. ### [CVE-2026-118650](https://cve.now/CVE-2026-118650): Echo: middleware.Static: \`%2F\`-encoded path bypasses route/group middleware guarding a statically-served path - Severity: High 7.5 - Published: Oct 28, 2026 - Affected: fixed in 5.4.0; from 5.0.0, fixed in 5.4.0. - Fixed in v5.4.0 (released Sep 27, 2026, 31 days before disclosure). - The latest release, v5.4.4, is not affected. ### [CVE-2026-118266](https://cve.now/CVE-2026-118266): Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method - Severity: Medium 5.3 - Published: Oct 28, 2026 - Affected: from 5.0.0, fixed in 5.4.0. - Fixed in v5.4.0 (released Sep 27, 2026, 31 days before disclosure). - The latest release, v5.4.4, is not affected. ### [CVE-2026-118265](https://cve.now/CVE-2026-118265): Echo: X-Real-IP extractor trusts the header value instead of the sending peer - Severity: Medium 5.3 - Published: Oct 28, 2026 - Affected: from 5.0.0, fixed in 5.4.1. - Fixed in v5.4.1 (released Oct 22, 2026, 6 days before disclosure). - The latest release, v5.4.4, is not affected. ### [CVE-2026-118264](https://cve.now/CVE-2026-118264): Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls - Severity: Critical 9.1 - Published: Oct 28, 2026 - Affected: from 5.0.0, fixed in 5.4.1. - Fixed in v5.4.1 (released Oct 22, 2026, 6 days before disclosure). - The latest release, v5.4.4, is not affected. ### [CVE-2026-118263](https://cve.now/CVE-2026-118263): Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests - Severity: Medium 6.3 - Published: Oct 28, 2026 - Affected: from 5.0.0, fixed in 5.4.1. - Fixed in v5.4.1 (released Oct 22, 2026, 6 days before disclosure). - The latest release, v5.4.4, is not affected. ### [CVE-2026-118262](https://cve.now/CVE-2026-118262): Echo: WebSocket proxy can retain connections and handlers after client disconnect - Severity: High 8.2 - Published: Oct 28, 2026 - Affected: from 5.0.0, fixed in 5.4.1. - Fixed in v5.4.1 (released Oct 22, 2026, 6 days before disclosure). - The latest release, v5.4.4, is not affected. ### [CVE-2026-55677](https://cve.now/CVE-2026-55677): Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files - Severity: High 7.5 - Published: Jun 26, 2026 - Affected: fixed in 5.2.0. - Fixed in v5.2.0 (released Jun 14, 2026, 12 days before disclosure). - The latest release, v5.4.4, is not affected. ### [CVE-2026-25766](https://cve.now/CVE-2026-25766): Echo has a Windows path traversal via backslash in middleware.Static default filesystem - Severity: Medium 5.3 - Published: Feb 19, 2026 - Affected: from 5.0.0, fixed in 5.0.3. - Fixed in v5.0.3 (released Feb 6, 2026, 13 days before disclosure). - The latest release, v5.4.4, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/labstack/echo/v5 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.