github.com/labstack/echo/v4 vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-118657Mediumgithub.com/labstack/echo/v5: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers CVE-2026-118654Mediumgithub.com/labstack/echo/v5: Echo static file middleware route protection bypass via encoded dot-dot traversal CVE-2026-118655Mediumgithub.com/labstack/echo/v5: Echo has a Static Middleware Double-Unescape Path Traversal CVE-2026-118656Mediumgithub.com/labstack/echo/v5: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI CVE-2026-118658Mediumgithub.com/labstack/echo/v5: Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto CVE-2026-118650Highgithub.com/labstack/echo/v5: Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path CVE-2026-118652Mediumgithub.com/labstack/echo/v5: Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob CVE-2026-118653Mediumgithub.com/labstack/echo/v5: Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration CVE-2026-118266Mediumgithub.com/labstack/echo/v5: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method CVE-2026-118651Mediumgithub.com/labstack/echo/v5: Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default CVE-2026-118262Highgithub.com/labstack/echo/v4: Echo: WebSocket proxy can retain connections and handlers after client disconnect CVE-2026-118261Highgithub.com/labstack/echo/v4: Echo: Decompress permits unbounded gzip expansion in v4 CVE-2026-118264Criticalgithub.com/labstack/echo/v4: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls CVE-2026-118260Highgithub.com/labstack/echo/v4: Echo: BodyDump captures request and response bodies without size limits in v4 CVE-2026-55677Highgithub.com/labstack/echo/v5: Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files CVE-2020-36565Mediumgithub.com/labstack/echo/v4: Echo vulnerable to directory traversal CVE-2022-40083Criticalgithub.com/labstack/echo/v4: Labstack Echo Open Redirect vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo