Security fixes
Upgrade with go get github.com/labstack/echo/v5@v5.4.1.
- Validate the sending peer before accepting
X-Real-IPinExtractIPFromRealIPHeader, preventing client IP spoofing when that extractor is configured. GHSA-h53f-rm2w-w7rg - Validate upstream WebSocket upgrade responses through Go's HTTP reverse proxy. Rejected upgrades no longer leave a raw tunnel that bypasses Echo routing and route middleware. GHSA-cxf3-9h37-7rr8
- Close both WebSocket connections when either side disconnects, including when an upstream ignores client EOF. GHSA-9969-6676-49h5
- Preserve the complete request body beyond the BodyDump capture limit and propagate read errors, including BodyLimit overflows. GHSA-x9ff-22gv-65f4, #3105
- Restore the original response writer before returning BodyDump buffers to the pool, preventing writes into a reused buffer during error handling. #3174
- Accept decompressed bodies exactly at the configured limit; keep overflow errors sticky. #3136
- Include the BodyLimit overflow-check correction and static-path hardening already merged since v5.4.0.
Behavior to review when upgrading
The proxy removes incoming Forwarded headers as defensive hardening. Backends relying on that header should use forwarding headers generated from the configured trusted IP extractor and scheme. WebSocket requests now honor the configured proxy transport, response modifier, target path and query in the same way as HTTP requests; ws and wss targets remain supported.
BodyDump capture limits bound logging only: handlers receive the full request, and clients receive the full response. Applications must still consume request bodies and handle read errors to enforce streaming body limits.
Go 1.25 remains the module minimum. Build deployments with a supported, patched Go toolchain.
Other changes
This release also includes ValidateCtx, router fixes for escaped colons, custom methods and parameter storage, binding support for OpenAPI date formats, and documentation updates.
Thanks to @rm-Umar, @Duodum, @irisitymichaelgrundberg, @Hama1cco, @jakezwang, @Shubham-Padkonde and @rajpreetcodes for reports and contributions, and to the contributors credited in the individual commits.
Validation: upstream lint checks and race tests passed on Linux, macOS and Windows with Go 1.25, 1.26 and 1.27. Local tests on patched toolchains, vet, staticcheck and govulncheck also passed; govulncheck reported no reachable vulnerabilities.
Full changelog: v5.4.0...v5.4.1