Go Echo (labstack/echo) CVE-2026-118264 (GHSA-cxf3-9h37-7rr8): Proxy middleware rejected WebSocket upgrades let later requests bypass route-level auth middleware. Am I affected and what's fixed?

What it is: A critical advisory published 2026-10-23 for the Echo web framework for Go. Echo's Proxy middleware switched to a raw tunnel as soon as a client asked for a WebSocket upgrade, before checking that the upstream accepted it. If the upstream answered with an ordinary HTTP response and kept the connection open, later requests on that connection went straight to the upstream without passing Echo's router or route-specific middleware, so authentication or authorization done only in Echo could be skipped. It requires a reachable proxy route, an upstream that rejects the upgrade without closing the connection, and an upstream resource with no authorization of its own. It doesn't allow proxying to arbitrary hosts or bypass the upstream's own authentication. Am I affected: - github.com/labstack/echo/v4 v4.0.0 to v4.16.0, or github.com/labstack/echo/v5 v5.0.0 to v5.4.0, and you use the Proxy middleware with auth enforced in Echo middleware in front of it. - Check: go list -m github.com/labstack/echo/v4 (or /v5) in your module, and search for middleware.Proxy. Fix: 1. Upgrade: go get github.com/labstack/echo/v4@v4.16.1 (or echo/v5@v5.4.1), go mod tidy, rebuild and redeploy. The fix routes upgrades through Go's standard reverse proxy and only tunnels after a valid upgrade response. 2. If you can't upgrade yet, reject WebSocket upgrade requests before they reach affected proxy routes, or enforce authorization on the upstream itself. The advisory notes that having the upstream merely return a non-101 response is not enough. 3. Long term, don't rely only on the proxy layer for authorization of sensitive upstream resources. Verify: go list -m shows v4.16.1+ or v5.4.1+, and govulncheck ./... no longer reports the issue. Sources: https://github.com/labstack/echo/security/advisories/GHSA-cxf3-9h37-7rr8 https://github.com/labstack/echo/releases/tag/v4.16.1 https://github.com/labstack/echo/releases/tag/v5.4.1 https://nvd.nist.gov/vuln/detail/CVE-2026-118264