GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo
Published Nov 5, 2026
·Updated
URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo
Affected Software
2 affected componentsFixes available
go/github.com/labstack/echo/v4<4.16.0
4.16.0
go/github.com/labstack/echo/v5>=5.0.0<5.4.0
5.4.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/labstack/echo/v4to a version that resolves this vulnerability.Fixed in 4.16.0 - Upgrade
Upgrade
go/github.com/labstack/echo/v5to a version that resolves this vulnerability.Fixed in 5.4.0
Event History
Nov 5, 2026
Advisory Published
via OSV·10:54 PM
Data Sourced
via OSV·10:54 PM
DescriptionAffected Software
Frequently Asked Questions
1
Which Echo branches are in scope?
The affected software list includes github.com/labstack/echo/v4 and github.com/labstack/echo/v5. Deployments using either branch should be reviewed.
2
Which application configurations are relevant when triaging this issue?
The issue applies where a statically served path is protected by route-level or group-level middleware. The bypass involves a URL-encoded path.