diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5593bac8c..86aed6fd1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,24 @@
 # Changelog
 
+## v4.16.4 - 2026-11-12
+
+**Security**
+
+* **Redirect middleware:** `HTTPSRedirect`, `HTTPSWWWRedirect`, `HTTPSNonWWWRedirect`, `WWWRedirect` and `NonWWWRedirect` now return `400 Bad Request` instead of redirecting when the host is empty, starts with `:` or `.`, contains `%`, or is empty after removing `www.`. Before this change, such hosts could produce an open redirect. The middleware no longer redirects `OPTIONS *` requests, maps `ws` and `wss` to `http` and `https` in redirect targets, and matches the `www.` prefix case-insensitively. Fixes [GHSA-3f6j-cw5h-qw9c](https://github.com/labstack/echo/security/advisories/GHSA-3f6j-cw5h-qw9c) ([#3217](https://github.com/labstack/echo/issues/3217)) in [#3224](https://github.com/labstack/echo/pull/3224).
+
+**Fixes**
+
+* **Trailing slash middleware:** `AddTrailingSlash` and `RemoveTrailingSlash` keep escaped path segments such as `%2F` in redirect and forward targets, so the request still matches its original route. Fixes [#3206](https://github.com/labstack/echo/issues/3206) in [#3225](https://github.com/labstack/echo/pull/3225).
+* **IPv6 zones:** `ExtractIPFromXFFHeader` and `ExtractIPFromRealIPHeader` trust zoned link-local proxy peers such as `[fe80::1%eth0]:8080`, with or without a port. Fixes [#3179](https://github.com/labstack/echo/issues/3179) in [#3226](https://github.com/labstack/echo/pull/3226).
+* **Header binding:** `BindHeaders` no longer panics on nil or empty header value slices. Fixes [#3169](https://github.com/labstack/echo/issues/3169) in [#3227](https://github.com/labstack/echo/pull/3227).
+
+**Behavior changes**
+
+* `Context.RealIP()` and `ExtractIPDirect()` now return a zoned link-local peer without its zone: `fe80::1`, not `fe80::1%eth0`. Update logs, allowlists or rate-limit keys that store the zoned form.
+* `HTTPSWWWRedirect` keeps its v4 behavior: it does not redirect plain HTTP requests for hosts that already start with `www.`. v5 redirects these requests.
+
+No public API, dependency or minimum Go-version changes; Go 1.26 or later remains required.
+
 ## v4.16.3 - 2026-10-29
 
 **Security**
diff --git a/echo.go b/echo.go
index b50a5c129..da0e59172 100644
--- a/echo.go
+++ b/echo.go
@@ -288,7 +288,7 @@ const (
 
 const (
 	// Version of Echo
-	Version = "4.16.3"
+	Version = "4.16.4"
 	website = "https://echo.labstack.com"
 	// http://patorjk.com/software/taag/#p=display&f=Small%20Slant&t=Echo
 	banner = `