Go/github.com/labstack/echo/v5 CVE-2026-55677: high 7.5, EPSS 0.43%

Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

Action: Upgrade github.com/labstack/echo/v5 to 5.2.0 or later.

go get github.com/labstack/echo/v5@v5.2.0

Affected

Fixed versions

Sources

• osv: GHSA-vfp3-v2gw-7wfq
• https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq
• https://nvd.nist.gov/vuln/detail/CVE-2026-55677
• https://github.com/labstack/echo/pull/3009
• https://github.com/labstack/echo/pull/3011
• https://github.com/labstack/echo/commit/8d1ae9d3360a71672418856d58753af25f2c3986
• https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725
• https://github.com/labstack/echo
• https://github.com/labstack/echo/releases/tag/v4.15.3
• https://github.com/labstack/echo/releases/tag/v5.2.0

CVE-2026-55677 · published 2026-08-25T16:13:29Z · modified 2026-09-10T03:51:14.774124457Z · JSON