Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-118651 · GHSA-99jh-6h7p-pp36

Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

Risk score
42/100
CVSS
5.3 v3.1
Published
28 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address, undermining IP-based access c…
Affected
github.com/labstack/echo/v5 (go) < 5.4.0; github.com/labstack/echo/v4 (go) >= 4.0.0, <= 4.16.2
Fix
Upgrade github.com/labstack/echo/v5 to 5.4.0 or later.
Exploitation
Public proof of concept

Story map

Story map: github.com/labstack/echo/v5THE FLAWSTHE FIXCVE-2026-118651Echo: Reverse Proxy ForwardsAttacker-Supplied X-Real-IPto Upstream by DefaultCVSS 5.3CVE-2026-118650Echo's middleware.Static:`%2F`-encoded path bypassesroute/group middleware…CVSS 7.5CVE-2026-118656Echo has Open Redirect viaControl-Character PrefixDefeating sanitizeURICVSS 6.1CVE-2026-118657Echo: HTTPS Redirect and HSTSBypass via Unconditional Trustof Forwarded Scheme HeadersCVSS 5.9Upgrade…4.16.0 · 5.4.0or later on your release lineWho is exposedgithub.com/labstack/echo/v5(go) < 5.4.0;github.com/labstack/echo/v4(go) < 4.16.0YELLOW · PLAN IT INgithub.com/labstack/echo/v5Echo is a Go web framework.Prior to 4.16.0 and 5.4.0, aglobally mountedmiddleware.Static instance caninterpret an encoded requestpath differently from Echo'srouter because the router…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-346 (CWE-346)61 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/labstack/echo/v5: Yellow, plan it in. Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates an encoded slash reso…

The flaws

  • CVE-2026-118651: Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default (CVSS 5.3)
  • CVE-2026-118650: Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path (CVSS 7.5)
  • CVE-2026-118656: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI (CVSS 6.1)
  • CVE-2026-118657: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers (CVSS 5.9)

The fix

Upgrade github.com/labstack/echo/v5: 4.16.0 · 5.4.0 or later on your release line

Who is exposed: github.com/labstack/echo/v5 (go) < 5.4.0; github.com/labstack/echo/v4 (go) < 4.16.0

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 5.3 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: Go

Affected packages

PackageEcosystemVulnerableFixed in
github.com/labstack/echo/v5go< 5.4.05.4.0
github.com/labstack/echo/v4go>= 4.0.0, <= 4.16.2No fix yet

References

Original description

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address, undermining IP-based access controls, rate limiting, audit logging, or geographic restrictions that trust Echo's forwarded identity. This issue is fixed in Echo 5.4.0.

Last activity 28 Oct 2026. Patch Forecast updates every hour.