GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

Q: Which Echo deployments should be prioritized for review?

Review applications using github.com/labstack/echo/v4 or github.com/labstack/echo/v5, particularly where HTTPS redirect or HSTS behavior is relied upon.

Q: What attacker capability is relevant to exploitation?

The issue concerns unconditional trust of forwarded scheme headers. Deployments should assess whether an attacker can cause forwarded scheme headers to be accepted with attacker-controlled values.

Q: How can I determine whether an application may be affected?

Identify whether the application uses either listed Echo module version family and uses Echo functionality for HTTPS redirects or HSTS. Also inspect whether forwarded scheme headers are accepted without a trusted-proxy boundary.

Published Nov 5, 2026

Updated

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

Affected Software

2 affected componentsFixes available

go/github.com/labstack/echo/v4<4.16.0

4.16.0

go/github.com/labstack/echo/v5<5.4.0

5.4.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade go/github.com/labstack/echo/v4 to a version that resolves this vulnerability.
Fixed in 4.16.0
Upgrade
Upgrade go/github.com/labstack/echo/v5 to a version that resolves this vulnerability.
Fixed in 5.4.0

Event History

Nov 5, 2026

Advisory Published

via OSV·10:54 PM

Data Sourced

via OSV·10:54 PM

DescriptionAffected Software

Frequently Asked Questions

Which Echo deployments should be prioritized for review?

Review applications using github.com/labstack/echo/v4 or github.com/labstack/echo/v5, particularly where HTTPS redirect or HSTS behavior is relied upon.

What attacker capability is relevant to exploitation?

The issue concerns unconditional trust of forwarded scheme headers. Deployments should assess whether an attacker can cause forwarded scheme headers to be accepted with attacker-controlled values.

How can I determine whether an application may be affected?

Identify whether the application uses either listed Echo module version family and uses Echo functionality for HTTPS redirects or HSTS. Also inspect whether forwarded scheme headers are accepted without a trusted-proxy boundary.

GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Echo deployments should be prioritized for review?

What attacker capability is relevant to exploitation?

How can I determine whether an application may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which Echo deployments should be prioritized for review?

What attacker capability is relevant to exploitation?

How can I determine whether an application may be affected?