github.com/labstack/echo/v5 vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-118657Mediumgithub.com/labstack/echo/v5: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers CVE-2026-118654Mediumgithub.com/labstack/echo/v5: Echo static file middleware route protection bypass via encoded dot-dot traversal CVE-2026-118655Mediumgithub.com/labstack/echo/v5: Echo has a Static Middleware Double-Unescape Path Traversal CVE-2026-118656Mediumgithub.com/labstack/echo/v5: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI CVE-2026-118658Mediumgithub.com/labstack/echo/v5: Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto CVE-2026-118650Highgithub.com/labstack/echo/v5: Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path CVE-2026-118652Mediumgithub.com/labstack/echo/v5: Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob CVE-2026-118653Mediumgithub.com/labstack/echo/v5: Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration CVE-2026-118266Mediumgithub.com/labstack/echo/v5: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method CVE-2026-118651Mediumgithub.com/labstack/echo/v5: Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default CVE-2026-118265Mediumgithub.com/labstack/echo/v5: Echo: X-Real-IP extractor trusts the header value instead of the sending peer CVE-2026-118262Highgithub.com/labstack/echo/v4: Echo: WebSocket proxy can retain connections and handlers after client disconnect CVE-2026-118264Criticalgithub.com/labstack/echo/v4: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls CVE-2026-118263Mediumgithub.com/labstack/echo/v5: Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests CVE-2026-55677Highgithub.com/labstack/echo/v5: Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files CVE-2026-25766Mediumgithub.com/labstack/echo/v5: Echo has a Windows path traversal via backslash in middleware.Static default filesystem

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo