Proxy identity hardening The proxy now retains its derived X-Real-IP header when an incoming request includes Connection: X-Real-IP, including mixed-case and duplicate Connection values. The value is restored after Go removes hop-by-hop headers, before the upstream transport runs. The same captured identity is preserved across retries and balancer request replacement, and the protection applies to…
Security and migration Applications behind proxies must configure Echo#IPExtractor to trust their own proxies before upgrading. Without an extractor, clients behind one proxy share its address for rate limiting, IP-based access controls, logging, and proxy forwarding. The safe default now ignores client-supplied IP headers. This release fixes the remaining v4 exposure for: CVE-2026-118651: Proxy a…
Security Upgrade to v5.4.3 to fix a static route-guard bypass involving encoded empty path segments in non-default path-matching or unescaping configurations. The confirmed impact is access to protected files inside a static root. The fix validates raw and decoded request paths and wildcard boundaries, including singly and doubly encoded leading slashes and guarded directory indexes. Advisory: GHS…
Fixes Require a space after the case-insensitive Basic authentication scheme. Malformed schemes such as BasicX no longer reach credential validation or consume AllowedCheckLimit. Valid credentials are still required. #3138, thanks to @Shubham-Padkonde. Reject empty cookie tokens and empty client tokens in CSRF validation. This is defense in depth; it does not introduce a new security advisory. #31…
Fixes Require a space after the case-insensitive Basic authentication scheme. Malformed schemes such as BasicX no longer invoke the credential validator. Valid credentials are still required. This adapts the v5 correction to v4's single-header API. #3188, backport of #3138, with credit to @Shubham-Padkonde. Reject empty cookie tokens and empty client tokens in CSRF validation. This is defense in d…
Security fixes Upgrade with go get github.com/labstack/echo/v5@v5.4.1. Validate the sending peer before accepting X-Real-IP in ExtractIPFromRealIPHeader, preventing client IP spoofing when that extractor is configured. GHSA-h53f-rm2w-w7rg Validate upstream WebSocket upgrade responses through Go's HTTP reverse proxy. Rejected upgrades no longer leave a raw tunnel that bypasses Echo routing and rout…
Security fixes Upgrade with go get github.com/labstack/echo/v4@v4.16.1. Go 1.26 or later is now required to use patched golang.org/x/ dependencies. Build deployments with a supported, patched Go toolchain. Validate upstream WebSocket upgrade responses through Go's HTTP reverse proxy. Rejected upgrades no longer leave a raw tunnel that bypasses Echo routing and route middleware. GHSA-cxf3-9h37-7rr8…
Security This release fixes several security issues. Upgrading is recommended. Some fixes change behavior; read "Behavior changes to check before upgrading" below. Request scheme: Context.Scheme() now uses the X-Forwarded-Proto, X-Forwarded-Protocol, X-Forwarded-Ssl and X-Url-Scheme headers only when the request comes directly from a loopback, link-local or private network address or a unix socket…
Security This release fixes several security issues. Upgrading is recommended. Some fixes change behavior; read "Behavior changes to check before upgrading" below. Request scheme: Context.Scheme() now uses the X-Forwarded-Proto, X-Forwarded-Protocol, X-Forwarded-Ssl and X-Url-Scheme headers only when the request comes directly from a loopback, link-local or private network address or a unix socket…
Fixes fix(static): preserve matched handler 404s by @JSap0914 in #3043 fix(group): Implicitly registered group routes should be allowed overwritten in default routes by @aldas in #3049 Enhancements docs: update HTTP badge URLs to HTTPS by @KeloYuan in #2968 docs: correct Any godoc to reflect true arbitrary-method matching by @hyorimitsu in #3046 refactor: use range-over-integer loops by @zxysilent…
Group middleware logic changes PR #2996 reverts back to v4 behavior for a group registering implicit 404 handlers. If you do not want this behavior, you do not want implicit 404 handlers for groups, use: e := echo.NewWithConfig(echo.Config{NoGroupAutoRegister404Routes: true}) g := e.Group("/api") Other noteworthy echancements: Adds first-class support for the QUERY HTTP method RFC 10008 in #3038 e…
Security Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler (used by Static/StaticFS) and the Static middleware are affected. Backport of the v5 fix (#3016, released in v5.2.1). Thanks to @a-tt-om and @oran-gugu for reporting. Make…
Security Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent. Given following situation: // 0. // given folder structure: // private.txt // public/ // public/index.html // public/text.txt // public/admin/private.txt // 1. share `public/` folder contents from the server root. This…
Security fix(static): reject encoded path separators that bypass route-level middleware by @vishr in #3011 Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler (used by Static/StaticFS) and the Static middleware are affected. Backport…
Security fix(static): reject encoded path separators that bypass route-level middleware by @vishr in #3009 fix(middleware/static): don't double-unescape request path (#2599) by @vishr in #3006 Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirec…
Security Context.Scheme() should validate values taken from header by @aldas in #2953 Thanks to @shblue21 for reporting this issue - Context.Scheme accepts malformed forwarded scheme values used by host redirects. Enhancements Add golangci linter configuration by @aldas in #2930 Make StartConfig listener creation context-aware by @EricGusmao in #2936 fix(lint): resolve staticcheck issues and impro…
Security Context.Scheme() should validate values taken from header by @aldas in #2962 Thanks to @shblue21 for reporting this issue. Full Changelog: v4.15.1...v4.15.2
Security This change does not break the API contract, but it does introduce breaking changes in logic/behavior. If your application is using c.RealIP() beware and read https://echo.labstack.com/docs/ip-address In v5 the c.RealIP() will now return request.RemoteAddr unless e.IPExtractor has been configured. No potentially spoofable headers are used by default anymore. Configure IPExtractor with pro…
What's Changed CSRF: support older token-based CSRF protection handler that want to render token into template by @aldas in #2905 Full Changelog: v4.15.0...v4.15.1
What's Changed Remove unused import 'errors' from README example by @kumapower17 in #2889 Fix Graceful shutdown: after http.Server.Serve returns we need to wait for graceful shutdown goroutine to finish by @aldas in #2898 Update location of oapi-codegen in README by @mromaszewicz in #2896 Add Go 1.26 to CI flow by @aldas in #2899 Add new function echo.StatusCode by @suwakei in #2892 CSRF: support…
Fix directory traversal vulnerability under Windows in Static middleware when default Echo filesystem is used. Reported by @shblue21 (#2891). This applies to cases when: Windows is used as OS middleware.StaticConfig.Filesystem is nil (default) echo.Filesystem is has not been set explicitly (default) Full Changelog: v5.0.2...v5.0.3