| Version | Supported |
|---|---|
| 5.x.x | ✅ |
| >= 4.15.x | ✅ until 2026.12.31 |
| < 4.15 | ❌ |
Report vulnerabilities privately through GitHub: https://github.com/labstack/echo/security/advisories/new
Do not open public issues, pull requests, or discussions for security problems.
Security: labstack/echo
Security
SECURITY.md
-
Encoded slash (%2F) bypasses route-level protection and exposes static filesGHSA-vfp3-v2gw-7wfq published
Jun 14, 2026 by vishrHigh -
Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-ProtoGHSA-23wf-92cp-8pcj published
Sep 27, 2026 by vishrModerate -
Windows path traversal via backslash in middleware.Static default filesystemGHSA-pgvm-wxw2-hrv9 published
Feb 17, 2026 by vishrModerate
Learn more about advisories related to labstack/echo in the GitHub Advisory Database