| Version | Supported |
|---|---|
| 5.x.x | ✅ |
| >= 4.15.x | ✅ until 2026.12.31 |
| < 4.15 | ❌ |
https://github.com/labstack/echo/security/advisories/new
or look for maintainers email(s) in commits and email them.
Security: labstack/echo
Security
SECURITY.md
-
Encoded slash (%2F) bypasses route-level protection and exposes static filesGHSA-vfp3-v2gw-7wfq published
Jun 14, 2026 by vishrHigh -
Windows path traversal via backslash in middleware.Static default filesystemGHSA-pgvm-wxw2-hrv9 published
Feb 17, 2026 by vishrModerate
Learn more about advisories related to labstack/echo in the GitHub Advisory Database