Echo Go framework: rejected WebSocket upgrades let requests bypass route-level auth in the Proxy middleware

Echo's Proxy middleware opened a raw tunnel as soon as a client asked for a WebSocket upgrade, before checking whether the upstream accepted it. If the upstream answered with an ordinary HTTP response and kept the connection alive, later HTTP requests on that connection went straight to the upstream without passing through Echo's router or route-specific middleware, which can bypass authentication or authorization enforced only at Echo's routes. It needs an accessible proxy route, an upstream that rejects the upgrade without closing the connection, and a target resource on that upstream without its own authorization. It affects the v4 and v5 release lines; upgrade to v4.16.1 or v5.4.1. GitHub rates it critical; no CVE id has been assigned yet.

Why this severity: GitHub-rated critical; only affects apps using Echo's Proxy middleware where the upstream relies on Echo for auth

Started

Oct 23, 2026

• Go
• #Labstack
• #Echo
• #WebSocket
• Auth bypass
• #Reverse proxy