Echo
Security incidents tagged Echo. Newest first.
1 Echo incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 0
- Longest quiet run: 0 days
- Patched
Echo Go framework: rejected WebSocket upgrades let requests bypass route-level auth in the Proxy middleware
Echo's Proxy middleware opened a raw tunnel as soon as a client asked for a WebSocket upgrade, before checking whether the upstream accepted it. If the upstream answered with an ordinary HTTP response and kept the connection alive, later HTTP requests on that connection went straight to the upstream without passing through Echo's router or route-specific middleware, which can bypass authentication or authorization enforced only at Echo's routes. It needs an accessible proxy route, an upstream that rejects the upgrade without closing the connection, and a target resource on that upstream without its own authorization. It affects the v4 and v5 release lines; upgrade to v4.16.1 or v5.4.1. GitHub rates it critical; no CVE id has been assigned yet.
Echo (github.com/labstack/echo) Proxy middlewareSince Oct 23, 2026
