labstack/echo v4.16.4

on GitHub

Security

• Redirect middleware: HTTPSRedirect, HTTPSWWWRedirect, HTTPSNonWWWRedirect, WWWRedirect and NonWWWRedirect now return 400 Bad Request instead of redirecting when the host is empty, starts with : or ., contains %, or is empty after removing www.. Before this change, such hosts could produce an open redirect. The middleware no longer redirects OPTIONS * requests, maps ws and wss to http and https in redirect targets, and matches the www. prefix case-insensitively. Fixes GHSA-3f6j-cw5h-qw9c (#3217) in #3224.

Fixes

• Trailing slash middleware: AddTrailingSlash and RemoveTrailingSlash keep escaped path segments such as %2F in redirect and forward targets, so the request still matches its original route. Fixes #3206 in #3225.
• IPv6 zones: ExtractIPFromXFFHeader and ExtractIPFromRealIPHeader trust zoned link-local proxy peers such as [fe80::1%eth0]:8080, with or without a port. Fixes #3179 in #3226.
• Header binding: BindHeaders no longer panics on nil or empty header value slices. Fixes #3169 in #3227.

Behavior changes

• Context.RealIP() and ExtractIPDirect() now return a zoned link-local peer without its zone: fe80::1, not fe80::1%eth0. Update logs, allowlists or rate-limit keys that store the zoned form.
• HTTPSWWWRedirect keeps its v4 behavior: it does not redirect plain HTTP requests for hosts that already start with www.. v5 redirects these requests.

No public API, dependency or minimum Go-version changes; Go 1.26 or later remains required.