Security
Upgrade to v5.4.3 to fix a static route-guard bypass involving encoded empty path segments in non-default path-matching or unescaping configurations. The confirmed impact is access to protected files inside a static root. The fix validates raw and decoded request paths and wildcard boundaries, including singly and doubly encoded leading slashes and guarded directory indexes.
Advisory: GHSA-v97q-3xf5-rj74
Fixes
- Decode path parameters only once when
UnescapePathParamValuesis enabled, preserving literal percent-containing values. - Correct
UseEscapedPathForMatchingdocumentation without changing its behavior. - Preserve correctly escaped filenames and static prefixes such as
/assets*.
Thanks to MyWorld319 for the static bypass report and alexreid for the parameter-decoding report.
Documentation
- Publish v4 support dates and the Echo Support offer (#3193).
- Mention Echo Pro in the Sponsors section (#3192).
Full Changelog: v5.4.2...v5.4.3