From e4a57f303177cc3146b962cb8d812a6fc747c50d Mon Sep 17 00:00:00 2001 From: Vishal Rana Date: Thu, 12 Nov 2026 00:47:30 -0800 Subject: [PATCH 1/3] chore: prepare v4.16.4 release --- CHANGELOG.md | 19 +++++++++++++++++++ echo.go | 2 +- 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5593bac8c..50dabd266 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,24 @@ # Changelog +## v4.16.4 - 2026-11-12 + +**Security** + +* **Redirect middleware:** `HTTPSRedirect`, `HTTPSWWWRedirect`, `HTTPSNonWWWRedirect`, `WWWRedirect` and `NonWWWRedirect` now return `400 Bad Request` for a host that is empty, starts with `:` or `.`, contains `%`, or is empty after removing `www.`. Before this change, such hosts could produce an open redirect. The middleware no longer redirects `OPTIONS *` requests, maps `ws` and `wss` to `http` and `https` in redirect targets, and matches the `www.` prefix case-insensitively. Fixes [#3217](https://github.com/labstack/echo/issues/3217) in [#3224](https://github.com/labstack/echo/pull/3224). + +**Fixes** + +* **Trailing slash middleware:** `AddTrailingSlash` and `RemoveTrailingSlash` keep escaped path segments such as `%2F` in redirect and forward targets, so the request still matches its original route. Fixes [#3206](https://github.com/labstack/echo/issues/3206) in [#3225](https://github.com/labstack/echo/pull/3225). +* **IPv6 zones:** `ExtractIPFromXFFHeader` and `ExtractIPFromRealIPHeader` trust zoned link-local proxy peers such as `[fe80::1%eth0]:8080`, with or without a port. Fixes [#3179](https://github.com/labstack/echo/issues/3179) in [#3226](https://github.com/labstack/echo/pull/3226). +* **Header binding:** `BindHeaders` no longer panics on nil or empty header value slices. Fixes [#3169](https://github.com/labstack/echo/issues/3169) in [#3227](https://github.com/labstack/echo/pull/3227). + +**Behavior changes** + +* `Context.RealIP()` and `ExtractIPDirect()` now return a zoned link-local peer without its zone: `fe80::1`, not `fe80::1%eth0`. Update logs, allowlists or rate-limit keys that store the zoned form. +* `HTTPSWWWRedirect` keeps its v4 behavior: it does not redirect plain HTTP requests for hosts that already start with `www.`. v5 redirects these requests. + +No public API, dependency or minimum Go-version changes; Go 1.26 or later remains required. + ## v4.16.3 - 2026-10-29 **Security** diff --git a/echo.go b/echo.go index b50a5c129..da0e59172 100644 --- a/echo.go +++ b/echo.go @@ -288,7 +288,7 @@ const ( const ( // Version of Echo - Version = "4.16.3" + Version = "4.16.4" website = "https://echo.labstack.com" // http://patorjk.com/software/taag/#p=display&f=Small%20Slant&t=Echo banner = ` From 04a501ef794b074605ee42c7f21f9ee4b958edce Mon Sep 17 00:00:00 2001 From: Vishal Rana Date: Thu, 12 Nov 2026 00:50:07 -0800 Subject: [PATCH 2/3] docs: link GHSA-3f6j-cw5h-qw9c in changelog --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 50dabd266..42b58ae8a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ **Security** -* **Redirect middleware:** `HTTPSRedirect`, `HTTPSWWWRedirect`, `HTTPSNonWWWRedirect`, `WWWRedirect` and `NonWWWRedirect` now return `400 Bad Request` for a host that is empty, starts with `:` or `.`, contains `%`, or is empty after removing `www.`. Before this change, such hosts could produce an open redirect. The middleware no longer redirects `OPTIONS *` requests, maps `ws` and `wss` to `http` and `https` in redirect targets, and matches the `www.` prefix case-insensitively. Fixes [#3217](https://github.com/labstack/echo/issues/3217) in [#3224](https://github.com/labstack/echo/pull/3224). +* **Redirect middleware:** `HTTPSRedirect`, `HTTPSWWWRedirect`, `HTTPSNonWWWRedirect`, `WWWRedirect` and `NonWWWRedirect` now return `400 Bad Request` for a host that is empty, starts with `:` or `.`, contains `%`, or is empty after removing `www.`. Before this change, such hosts could produce an open redirect. The middleware no longer redirects `OPTIONS *` requests, maps `ws` and `wss` to `http` and `https` in redirect targets, and matches the `www.` prefix case-insensitively. Fixes [GHSA-3f6j-cw5h-qw9c](https://github.com/labstack/echo/security/advisories/GHSA-3f6j-cw5h-qw9c) ([#3217](https://github.com/labstack/echo/issues/3217)) in [#3224](https://github.com/labstack/echo/pull/3224). **Fixes** From accccb21e4d74d91bcb4e262fe9e14f1549f0c11 Mon Sep 17 00:00:00 2001 From: Vishal Rana Date: Thu, 12 Nov 2026 01:09:11 -0800 Subject: [PATCH 3/3] docs: clarify when redirect middleware returns 400 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 42b58ae8a..86aed6fd1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ **Security** -* **Redirect middleware:** `HTTPSRedirect`, `HTTPSWWWRedirect`, `HTTPSNonWWWRedirect`, `WWWRedirect` and `NonWWWRedirect` now return `400 Bad Request` for a host that is empty, starts with `:` or `.`, contains `%`, or is empty after removing `www.`. Before this change, such hosts could produce an open redirect. The middleware no longer redirects `OPTIONS *` requests, maps `ws` and `wss` to `http` and `https` in redirect targets, and matches the `www.` prefix case-insensitively. Fixes [GHSA-3f6j-cw5h-qw9c](https://github.com/labstack/echo/security/advisories/GHSA-3f6j-cw5h-qw9c) ([#3217](https://github.com/labstack/echo/issues/3217)) in [#3224](https://github.com/labstack/echo/pull/3224). +* **Redirect middleware:** `HTTPSRedirect`, `HTTPSWWWRedirect`, `HTTPSNonWWWRedirect`, `WWWRedirect` and `NonWWWRedirect` now return `400 Bad Request` instead of redirecting when the host is empty, starts with `:` or `.`, contains `%`, or is empty after removing `www.`. Before this change, such hosts could produce an open redirect. The middleware no longer redirects `OPTIONS *` requests, maps `ws` and `wss` to `http` and `https` in redirect targets, and matches the `www.` prefix case-insensitively. Fixes [GHSA-3f6j-cw5h-qw9c](https://github.com/labstack/echo/security/advisories/GHSA-3f6j-cw5h-qw9c) ([#3217](https://github.com/labstack/echo/issues/3217)) in [#3224](https://github.com/labstack/echo/pull/3224). **Fixes**