Echo WebSocket Route Access Bypass (CVE-2026-118264)

Echo's Proxy middleware forwards requests to a configured upstream server. The flaw concerns how it handles a client's request to switch from HTTP to WebSocket. The old code chose a raw tunnel before checking whether the upstream had accepted that switch.

An upstream could reject the upgrade with an ordinary HTTP response yet keep the connection open. Later HTTP requests on that connection then went straight to the same upstream. They skipped Echo's router and the checks tied to individual routes.

Authentication or authorization enforced only at those Echo routes could be bypassed. The upstream's own access checks still apply. The advisory does not describe a way to choose arbitrary hosts. It also does not establish remote code execution or attacks in the wild.

Three conditions matter together: the proxy route is reachable, the upstream rejects the upgrade without closing the connection, and the target resource lacks its own authorization. A vulnerable version alone does not show that all three conditions hold.

For related application risks, see our Fastify Express middleware bypass and Jackson polymorphic type bypass. Our developer security guide covers secure coding practice.

The v4 module, github.com/labstack/echo/v4, is affected from 4.0.0 up to, but excluding, 4.16.1. The v5 module, github.com/labstack/echo/v5, is affected from 5.0.0 up to, but excluding, 5.4.1. The maintainer confirmed the behavior at runtime in 4.15.0, 4.16.0, 5.0.0, and 5.4.0.

Source history also shows the missing upgrade-response check in 4.0.0. The patched releases are 4.16.1 for the v4 line and 5.4.1 for v5. The fix uses Go's HTTP reverse proxy and opens a tunnel only after a valid upstream upgrade response. Rejected upgrades stay ordinary HTTP requests.

The v4.16.1 release requires Go 1.26 or later. The v5.4.1 release keeps Go 1.25 as its module minimum. Use a supported, patched Go toolchain and test the chosen release with the application. These toolchain requirements differ between the two major lines.

The maintainer published the advisory and fixed releases on 22 October 2026. The CVE Program record was published on 28 October. Those are separate events; the later CVE record does not mean the patches first became available that day.