v5.4.1

{
  "id": "81152551cc90fa56ffb1ef6fe6474b540bcfd1738c49a046a78e4c0a516f8b30",
  "url": "https://github.com/labstack/echo/releases/tag/v5.4.1",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "v5.4.1",
    "summary": "Echo v5.4.1 fixes security issues involving trusted peer validation for X-Real-IP and WebSocket reverse-proxy handling, and includes additional request-body and response-writer fixes.",
    "evidence": "Security fixes Upgrade with go get github.com/labstack/echo/v5@v5.4.1. Validate the sending peer before accepting X-Real-IP in ExtractIPFromRealIPHeader, preventing client IP spoofing when that extractor is configured. GHSA-h53f-rm2w-w7rg Validate upstream WebSocket upgrade responses through Go's HTTP reverse proxy.",
    "products": [
      {
        "name": {
          "value": "github.com/labstack/echo/v5",
          "evidence": "Upgrade with go get github.com/labstack/echo/v5@v5.4.1."
        },
        "prerequisites": [
          {
            "value": "when that extractor is configured",
            "evidence": "Validate the sending peer before accepting X-Real-IP in ExtractIPFromRealIPHeader, preventing client IP spoofing when that extractor is configured."
          }
        ],
        "fixed_versions": [
          {
            "value": "v5.4.1",
            "evidence": "Upgrade with go get github.com/labstack/echo/v5@v5.4.1."
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-labstack-echo",
  "document_id": 21587,
  "published_at": "2026-10-22T16:32:50+00:00"
}