github.com/labstack/echo/v4

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium4.7

CVE-2026-118658Fix available

Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto

Go / github.com/labstack/echo/v5 Go / github.com/labstack/echo/v4

2 days ago

github.com/labstack/echo/v4 Go

Affected range	Recorded fix
Earlier releases before 4.15.2Semantic versions	4.15.2

Version evidence: OSV · GHSA-23wf-92cp-8pcj

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "4.15.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

medium5.9

CVE-2026-118657Fix available

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

Go / github.com/labstack/echo/v5 Go / github.com/labstack/echo/v4

2 days ago

github.com/labstack/echo/v4 Go

Affected range	Recorded fix
Earlier releases before 4.16.0Semantic versions	4.16.0

Version evidence: OSV · GHSA-2ffq-g2xg-c22p

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "4.16.0"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

medium6.1

CVE-2026-118656Fix available

Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI

Go / github.com/labstack/echo/v5 Go / github.com/labstack/echo/v4

2 days ago

github.com/labstack/echo/v4 Go

Affected range	Recorded fix
Earlier releases before 4.16.0Semantic versions	4.16.0

Version evidence: OSV · GHSA-v753-g4cw-jm48

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "4.16.0"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

medium5.9

CVE-2026-118655Fix available

Echo has a Static Middleware Double-Unescape Path Traversal

Go / github.com/labstack/echo/v5 Go / github.com/labstack/echo/v4

2 days ago

github.com/labstack/echo/v4 Go

Affected range	Recorded fix
Earlier releases before 4.15.3Semantic versions	4.15.3

Version evidence: OSV · GHSA-xwq5-6cqp-vx96

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "4.15.3"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

medium5.9

CVE-2026-118654Fix available

Echo static file middleware route protection bypass via encoded dot-dot traversal

Go / github.com/labstack/echo/v5 Go / github.com/labstack/echo/v4

2 days ago

github.com/labstack/echo/v4 Go

Affected range	Recorded fix
Earlier releases before 4.16.0Semantic versions	4.16.0

Version evidence: OSV · GHSA-3pmx-cf9f-34xr

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "4.16.0"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

medium5.3

CVE-2026-118653Fix available

Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

Go / github.com/labstack/echo/v5 Go / github.com/labstack/echo/v4

2 days ago

github.com/labstack/echo/v4 Go

Affected range	Recorded fix
From 4.0.0 through 4.16.2 (inclusive)Semantic versions	Not recorded

Version evidence: OSV · GHSA-246p-cpwv-v3jq

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "4.0.0"
        },
        {
          "last_affected": "4.16.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

medium6.1

CVE-2026-118652Fix available

Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

Go / github.com/labstack/echo/v5 Go / github.com/labstack/echo/v4

2 days ago

github.com/labstack/echo/v4 Go

Affected range	Recorded fix
Earlier releases before 4.16.0Semantic versions	4.16.0

Version evidence: OSV · GHSA-h9g5-28mm-hx3g

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "4.16.0"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

medium5.3

CVE-2026-118651Fix available

Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

Go / github.com/labstack/echo/v5 Go / github.com/labstack/echo/v4

2 days ago

github.com/labstack/echo/v4 Go

Affected range	Recorded fix
From 4.0.0 through 4.16.2 (inclusive)Semantic versions	Not recorded

Version evidence: OSV · GHSA-99jh-6h7p-pp36

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "4.0.0"
        },
        {
          "last_affected": "4.16.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

high7.5

GHSA-375p-5qhx-8wq4Fix available

Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

Go / github.com/labstack/echo/v5 Go / github.com/labstack/echo/v4

2 days ago

github.com/labstack/echo/v4 Go

Affected range	Recorded fix
Earlier releases before 4.16.0Semantic versions	4.16.0

Version evidence: OSV · GHSA-375p-5qhx-8wq4

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "4.16.0"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

medium5.3

GHSA-r7w9-592q-9vg4Fix available

Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Go / github.com/labstack/echo/v5 Go / github.com/labstack/echo/v4

2 days ago

github.com/labstack/echo/v4 Go

Affected range	Recorded fix
Earlier releases before 4.16.0Semantic versions	4.16.0

Version evidence: OSV · GHSA-r7w9-592q-9vg4

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "4.16.0"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

high8.2

GHSA-9969-6676-49h5Fix available

Echo: WebSocket proxy can retain connections and handlers after client disconnect

Go / github.com/labstack/echo/v4 Go / github.com/labstack/echo/v5

7 days ago

github.com/labstack/echo/v4 Go

Affected range	Recorded fix
From 4.15.0 before 4.16.1Semantic versions	4.16.1

Version evidence: OSV · GHSA-9969-6676-49h5

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "4.15.0"
        },
        {
          "fixed": "4.16.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

high8.2

GHSA-h7wr-284f-5qvcFix available

Echo: Decompress permits unbounded gzip expansion in v4

Go / github.com/labstack/echo/v4

7 days ago

github.com/labstack/echo/v4 Go

Affected range	Recorded fix
From 4.0.0 before 4.16.1Semantic versions	4.16.1

Version evidence: OSV · GHSA-h7wr-284f-5qvc

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "4.0.0"
        },
        {
          "fixed": "4.16.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

critical9.1

CVE-2026-118264Fix available

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

Go / github.com/labstack/echo/v4 Go / github.com/labstack/echo/v5

7 days ago

github.com/labstack/echo/v4 Go

Affected range	Recorded fix
From 4.0.0 before 4.16.1Semantic versions	4.16.1

Version evidence: OSV · GHSA-cxf3-9h37-7rr8

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "4.0.0"
        },
        {
          "fixed": "4.16.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

high8.2

CVE-2026-118260Fix available

Echo: BodyDump captures request and response bodies without size limits in v4

Go / github.com/labstack/echo/v4

7 days ago

github.com/labstack/echo/v4 Go

Affected range	Recorded fix
From 4.0.0 before 4.16.1Semantic versions	4.16.1

Version evidence: OSV · GHSA-f48p-c9v4-h7xv

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "4.0.0"
        },
        {
          "fixed": "4.16.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}