Security and migration
Applications behind proxies must configure Echo#IPExtractor to trust their own proxies before upgrading. Without an extractor, clients behind one proxy share its address for rate limiting, IP-based access controls, logging, and proxy forwarding. The safe default now ignores client-supplied IP headers.
This release fixes the remaining v4 exposure for:
- CVE-2026-118651: Proxy always derives upstream
X-Real-IPfromContext.RealIP(), including after hop-by-hop header stripping and on WebSocket upgrades. One derived identity is preserved across retries. - CVE-2026-118653:
Context.RealIP()uses the connection peer whenIPExtractoris unset, so rotating spoofed forwarded-IP headers cannot create fresh default rate-limit buckets.
Use echo.ExtractIPDirect() without a proxy. Behind a proxy, use ExtractIPFromXFFHeader or ExtractIPFromRealIPHeader with trust restricted to your proxies. Configure the outermost proxy to replace client-supplied identity headers. Explicit extractors and custom rate-limit identifiers retain their behavior.
Migration example with explicit proxy trust ranges
Other changes
- Resolve bare IPv4 and IPv6 connection addresses without a port.
- Document v4 support dates (#3194).
No dependency or minimum Go-version changes; Go 1.26 or later remains required.
The security fix (#3197) passed independent agent and Claude reviews, full race tests on Go 1.26 and 1.27, and GitHub Linux/macOS/Windows checks.
Full Changelog: v4.16.2...v4.16.3