#echo

Deep Dive

Rejected WebSocket upgrades through Echo's Proxy middleware leave a raw tunnel open to the upstream, and later HTTP requests on that connection skip Echo's router and route middleware, so authentication enforced only at Echo routes is bypassed. The GitHub Advisory Database rates it Critical, CVSS v4.0 9.1, while Echo's own advisory rates it Moderate. Fixed in v4.16.1 and v5.4.1, released October 22, 2026. No public proof of concept and no exploitation in the wild are known.