VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/labstack/echo/v4: vulnerability history, versions and safety

github.com/labstack/echo/v4 is a package in the Go ecosystem. Vulert records 5 vulnerabilities for it across 120 releases, from Apr 2021 to Aug 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
5 vulnerabilities recorded C1 M1 U3
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
1 in the last 12 months

Most recent disclosure 26 Aug 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/labstack/echo/v4 vulnerabilities

Vulert verdict on github.com/labstack/echo/v4 v4.16.1 i

Updated on 22 Oct 2026

Action needed: v4.16.1 has 5 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 84/100
  • Security Minor issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v4.16.1 — affected i
  • Vulnerabilities on record 5 over 5 years · 1 in the last year i
  • Latest disclosure 26 Aug 2026 i
  • Highest CVSS 9.6 i
  • With no published fix 0 i
  • Stars 32,776 i
  • OpenSSF scorecard 5/10 i
  • Last release this month i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/labstack/echo/v4, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v4.16.1 22 Oct 2026 C1 M1 U3 MIT Yes Details →
v4.16.1-0.20261006025214-be0800562a0b 06 Oct 2026 C1 M1 U3 MIT Yes Details →
v4.16.0 27 Sep 2026 C1 M1 U3 MIT Yes Details →
v4.15.5-0.20260706201043-4f2f975ddadd 06 Jul 2026 C1 M1 U3 MIT Yes Details →
v4.15.4 15 Jun 2026 C1 M1 U3 MIT Yes Details →
v4.15.3 14 Jun 2026 C1 M1 U3 MIT Yes Details →
v4.15.3-0.20260614161552-c3fa2a27ff92 14 Jun 2026 C1 M1 U3 MIT Yes Details →
v4.15.2 01 May 2026 C1 M1 U3 MIT Yes Details →
v4.15.1 22 Feb 2026 C1 M1 U3 MIT Yes Details →
v4.15.0 01 Jan 2026 C1 M1 U3 MIT Yes Details →
v4.14.1-0.20251228212131-4dcb9b44f0a1 28 Dec 2025 C1 M1 U3 MIT Yes Details →
v4.14.1-0.20251212111053-321530d2c2d1 12 Dec 2025 C1 M1 U3 MIT Yes Details →
v4.14.0 11 Dec 2025 C1 M1 U3 MIT Yes Details →
v4.13.5-0.20251122143322-612967a9fec1 22 Nov 2025 C1 M1 U3 MIT Yes Details →
v4.13.5-0.20251026172629-53b692c4d4de 26 Oct 2025 C1 M1 U3 MIT Yes Details →
v4.13.5-0.20251015184624-e644ff8f7bb0 15 Oct 2025 C1 M1 U3 MIT Yes Details →
v4.0.0-20250926084813-55cb3b625d12 26 Sep 2025 C1 M1 U3 MIT Yes Details →
v4.13.5-0.20250926084813-55cb3b625d12 26 Sep 2025 C1 M1 U3 MIT Yes Details →
v4.13.5-0.20250916050828-52d2bff1b9eb 16 Sep 2025 C1 M1 U3 MIT Yes Details →
v4.13.5-0.20250916020827-d0137c3e8087 16 Sep 2025 C1 M1 U3 MIT Yes Details →
v4.13.5-0.20250829145306-5ac2f11f21b7 29 Aug 2025 C1 M1 U3 MIT Yes Details →
v4.13.5-0.20250825193258-9acf5341821c 25 Aug 2025 C1 M1 U3 MIT Yes Details →
v4.13.5-0.20250812085752-8493c61ede58 12 Aug 2025 C1 M1 U3 MIT Yes Details →
v4.13.4 22 May 2025 C1 M1 U3 MIT Yes Details →
v4.13.4-0.20250404080142-de44c53a5b16 04 Apr 2025 C1 M1 U3 MIT Yes Details →
v4.13.4-0.20250212171734-c44f6283f02a 12 Feb 2025 C1 M1 U3 MIT Yes Details →
v4.13.4-0.20250112072838-ce0b12ae531b 12 Jan 2025 C1 M1 U3 MIT Yes Details →
v4.13.4-0.20250107200628-ee3e1297788e 07 Jan 2025 C1 M1 U3 MIT Yes Details →
v4.13.3 19 Dec 2024 C1 M1 U3 MIT Yes Details →
v4.13.2 12 Dec 2024 C1 M1 U3 MIT Yes Details →
v4.13.1 11 Dec 2024 C1 M1 U3 MIT Yes Details →
v4.12.1-0.20241204201345-3b017855b4d3 04 Dec 2024 C1 M1 U3 MIT Yes Details →
v4.13.0 04 Dec 2024 C1 M1 U3 MIT Yes Details →
v4.12.1-0.20241125202156-fe2627778114 25 Nov 2024 C1 M1 U3 MIT Yes Details →
v4.12.1-0.20241122205455-9e73691837f5 22 Nov 2024 C1 M1 U3 MIT Yes Details →
v4.12.1-0.20241118195643-5d98929328ad 18 Nov 2024 C1 M1 U3 MIT Yes Details →
v4.12.1-0.20241026124447-5a0b4dd80635 26 Oct 2024 C1 M1 U3 MIT Yes Details →
v4.12.1-0.20241020182151-822d11a465aa 20 Oct 2024 C1 M1 U3 MIT Yes Details →
v4.12.1-0.20241006205323-ab87b63640f2 06 Oct 2024 C1 M1 U3 MIT Yes Details →
v4.12.1-0.20240816061652-27c55f2189e0 16 Aug 2024 C1 M1 U3 MIT Yes Details →
v4.12.1-0.20240816061652-d20a6257aa12 16 Aug 2024 C1 M1 U3 MIT Yes Details →
v4.12.1-0.20240722043301-f13e2640f0ea 22 Jul 2024 C1 M1 U3 MIT Yes Details →
v4.12.1-0.20240530195001-f7d9f5142e9a 30 May 2024 C1 M1 U3 MIT Yes Details →
v4.11.5-0.20240415183101-88c379ff7727 15 Apr 2024 C1 M1 U3 MIT Yes Details →
v4.12.0 15 Apr 2024 C1 M1 U3 MIT Yes Details →
v4.11.5-0.20240327102846-447c92d842e2 27 Mar 2024 C1 M1 U3 MIT Yes Details →
v4.11.5-0.20240321214216-d549290448fc 21 Mar 2024 C1 M1 U3 MIT Yes Details →
v4.11.5-0.20240313200708-011acb4732fe 13 Mar 2024 C1 M1 U3 MIT Yes Details →
v4.11.5-0.20240311204958-c57fcb3746c4 11 Mar 2024 C1 M1 U3 MIT Yes Details →
v4.11.5-0.20240310170454-a3b0ba24d359 10 Mar 2024 C1 M1 U3 MIT Yes Details →
v4.11.5-0.20240309155307-3598f295f95f 09 Mar 2024 C1 M1 U3 MIT Yes Details →
v4.11.5-0.20240309092813-5f7bedfb86e1 09 Mar 2024 C1 M1 U3 MIT Yes Details →
v4.11.5-0.20240306195253-3e04e3e2f25c 06 Mar 2024 C1 M1 U3 MIT Yes Details →
v4.11.5-0.20240218134713-fa70db801e3d 18 Feb 2024 C1 M1 U3 MIT Yes Details →
v4.11.5-0.20240213181618-ea529bbab660 13 Feb 2024 C1 M1 U3 MIT Yes Details →
v4.11.5-0.20240207055421-29aab274b381 07 Feb 2024 C1 M1 U3 MIT Yes Details →
v4.11.5-0.20240206054133-76994d17d59d 06 Feb 2024 C1 M1 U3 MIT Yes Details →
v4.11.5-0.20240128151651-f12fdb09cd4d 28 Jan 2024 C1 M1 U3 MIT Yes Details →
v4.11.5-0.20240124154540-b83549824198 24 Jan 2024 C1 M1 U3 MIT Yes Details →
v4.11.5-0.20240123032605-d26212069089 23 Jan 2024 C1 M1 U3 MIT Yes Details →
v4.11.5-0.20231220133251-60fc2fb1b76f 20 Dec 2023 C1 M1 U3 MIT Yes Details →
v4.11.4 20 Dec 2023 C1 M1 U3 MIT Yes Details →
v4.11.4-0.20231219160723-287a82c228ef 19 Dec 2023 C1 M1 U3 MIT Yes Details →
v4.11.4-0.20231107130943-584cb85a6b74 07 Nov 2023 C1 M1 U3 MIT Yes Details →
v4.11.3 07 Nov 2023 C1 M1 U3 MIT Yes Details →
v4.11.3-0.20231105160101-c7d6d4373fdf 05 Nov 2023 C1 M1 U3 MIT Yes Details →
v4.0.0-20231024181213-69a0de84158f 24 Oct 2023 C1 M1 U3 MIT Yes Details →
v4.11.3-0.20231024181213-69a0de84158f 24 Oct 2023 C1 M1 U3 MIT Yes Details →
v4.11.2 11 Oct 2023 C1 M1 U3 MIT Yes Details →
v4.11.2-0.20231011053223-98a523756d87 11 Oct 2023 C1 M1 U3 MIT Yes Details →
v4.11.2-0.20230919052447-4bc3e475e313 19 Sep 2023 C1 M1 U3 MIT Yes Details →
v4.11.2-0.20230913194158-3950c444b726 13 Sep 2023 C1 M1 U3 MIT Yes Details →
v4.11.2-0.20230812060130-77d5ae6a9173 12 Aug 2023 C1 M1 U3 MIT Yes Details →
v4.11.2-0.20230722204735-e6b96f8873fe 22 Jul 2023 C1 M1 U3 MIT Yes Details →
v4.11.2-0.20230721101056-626f13e33830 21 Jul 2023 C1 M1 U3 MIT Yes Details →
v4.11.2-0.20230718162005-4598a4a7458f 18 Jul 2023 C1 M1 U3 MIT Yes Details →
v4.11.1 16 Jul 2023 C1 M1 U3 MIT Yes Details →
v4.11.1-0.20230716174157-a2e7085094bd 16 Jul 2023 C1 M1 U3 MIT Yes Details →
v4.10.3-0.20230714201822-60af056959d5 14 Jul 2023 C1 M1 U3 MIT Yes Details →
v4.11.0 14 Jul 2023 C1 M1 U3 MIT Yes Details →
v4.0.0-20230711203605-1ee8e22faa4e 11 Jul 2023 C1 M1 U3 MIT Yes Details →
v4.10.3-0.20230711203605-1ee8e22faa4e 11 Jul 2023 C1 M1 U3 MIT Yes Details →
v4.10.3-0.20230710092439-44ead54c8c99 10 Jul 2023 C1 M1 U3 MIT Yes Details →
v4.10.3-0.20230531055333-42f07ed88040 31 May 2023 C1 M1 U3 MIT Yes Details →
v4.10.3-0.20230529202653-fbfe2167f1d2 29 May 2023 C1 M1 U3 MIT Yes Details →
v4.10.3-0.20230512191429-8e425c04311c 12 May 2023 C1 M1 U3 MIT Yes Details →
v4.10.3-0.20230501060136-deb17d2388a7 01 May 2023 C1 M1 U3 MIT Yes Details →
v4.10.3-0.20230422183745-0d47b7e6a93d 22 Apr 2023 C1 M1 U3 MIT Yes Details →
v4.10.3-0.20230416181347-7d54690cdc4b 16 Apr 2023 C1 M1 U3 MIT Yes Details →
v4.10.3-0.20230415184833-de1c798143d3 15 Apr 2023 C1 M1 U3 MIT Yes Details →
v4.10.3-0.20230406103741-a7802ea523e5 06 Apr 2023 C1 M1 U3 MIT Yes Details →
v4.10.3-0.20230331175908-c0bc886b78b8 31 Mar 2023 C1 M1 U3 MIT Yes Details →
v4.10.3-0.20230316054603-f22ba6725c66 16 Mar 2023 C1 M1 U3 MIT Yes Details →
v4.10.3-0.20230302211452-ec642f7df11b 02 Mar 2023 C1 M1 U3 MIT Yes Details →
v4.10.3-0.20230224183241-5b36ce36127b 24 Feb 2023 C1 M1 U3 MIT Yes Details →
v4.10.3-0.20230224110940-1e575b7b56d7 24 Feb 2023 C1 M1 U3 MIT Yes Details →
v4.10.2 21 Feb 2023 C1 M1 U3 MIT Yes Details →
v4.10.1 19 Feb 2023 C1 M1 U3 MIT Yes Details →
v4.10.1-0.20230219191217-b888a30fe394 19 Feb 2023 C1 M1 U3 MIT Yes Details →
v4.10.1-0.20230210124325-6b09f3ffeb50 10 Feb 2023 C1 M1 U3 MIT Yes Details →
v4.10.1-0.20230201203820-82a964c657e2 01 Feb 2023 C1 M1 U3 — Yes Details →
v4.10.1-0.20230128161549-08093a4a1dbd 28 Jan 2023 C1 M1 U3 — Yes Details →
v4.10.1-0.20230103220930-24a30611dfc0 03 Jan 2023 C1 M1 U3 — Yes Details →
v4.10.0 27 Dec 2022 C1 M1 U3 — Yes Details →
v4.9.2-0.20221225201915-0056cc8ec00f 25 Dec 2022 C1 M1 U3 — Yes Details →
v4.9.2-0.20221217091600-895121d17801 17 Dec 2022 C1 M1 U3 — Yes Details →
v4.9.2-0.20221214133113-abecadcbdc38 14 Dec 2022 C1 M1 U3 — Yes Details →
v4.9.2-0.20221208194816-40eb889d1400 08 Dec 2022 C1 M1 U3 — Yes Details →
v4.9.2-0.20221204183845-135c511f5dd1 04 Dec 2022 C1 M1 U3 — Yes Details →
v4.9.2-0.20221130134723-8d4ac4c90769 30 Nov 2022 C1 M1 U3 — Yes Details →
v4.0.0-20221125112752-466bf80e418b 25 Nov 2022 C1 M1 U3 — Yes Details →
v4.9.2-0.20221125112752-466bf80e418b 25 Nov 2022 C1 M1 U3 — Yes Details →
v4.9.2-0.20221124201731-754479694694 24 Nov 2022 C1 M1 U3 — Yes Details →
v4.9.2-0.20221123074240-36ff0b3fbd9b 23 Nov 2022 C1 M1 U3 — Yes Details →
v4.9.2-0.20221121142613-a0c211542ccf 21 Nov 2022 C1 M1 U3 — Yes Details →
v4.9.2-0.20221119210516-be23ab67ccdc 19 Nov 2022 C1 M1 U3 — Yes Details →
v4.9.2-0.20221112215647-fd2b102d3ee1 12 Nov 2022 C1 M1 U3 — Yes Details →
v4.9.2-0.20221029185423-0ce73028d081 29 Oct 2022 C1 M1 U3 — Yes Details →
v4.9.2-0.20221018085153-8f2bf82982a6 18 Oct 2022 C1 M1 U3 — Yes Details →
v4.9.1 12 Oct 2022 C1 M1 U3 — Yes Details →

The newest 120 of 515 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 1
  • 2022 3
  • 2026 1

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 1 of the 5 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/labstack/echo/v4

The 5 most severe of 5 vulnerabilities recorded for this package

Search all 5 in the database →
Vulnerability Severity Fixed version ↑ Disclosed ↑
CVE-2022-40083: Labstack Echo Open Redirect vulnerability 9.6 critical 4.9.0 29 Sep 2022
CVE-2020-36565: Directory Traversal Vulnerability in github.com/labstack/echo/v4 5.3 medium 4.2.0 07 Dec 2022
CVE-2020-36565: Directory Traversal Vulnerability in github.com/labstack/echo/v4 N/A unrated 4.1.18-0.20201215153152-4422e3b66b9f 14 Apr 2021
CVE-2022-40083: Open redirect in github.com/labstack/echo/v4 N/A unrated 4.9.0 11 Oct 2022
CVE-2026-55677: Bypass of Route-Level Protection in Labstack Echo Packages N/A unrated 4.15.3 26 Aug 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 22/Oct/2026 · Vulnerabilities in our DB: 524173

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/labstack/echo/v4

Is github.com/labstack/echo/v4 safe to use?

Vulert records 5 vulnerabilities for github.com/labstack/echo/v4 in Go: 1 critical, 0 high, 1 medium and 0 low, plus 3 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/labstack/echo/v4's Vulert package health score?

Vulert scores github.com/labstack/echo/v4 84/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/labstack/echo/v4 affected?

Yes. v4.16.1, the version you would install today, has 5 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

How many vulnerabilities does github.com/labstack/echo/v4 have?

5 vulnerabilities are recorded for github.com/labstack/echo/v4 in the Go ecosystem: 1 critical, 0 high, 1 medium and 0 low, plus 3 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/labstack/echo/v4 vulnerabilities disclosed?

1 vulnerability was recorded for github.com/labstack/echo/v4 in the last 12 months, and the oldest entry in this database dates to 14 Apr 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/labstack/echo/v4 are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/labstack/echo/v4 for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/labstack/echo/v4 version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.