echotest

Sep 27, 2026 GO-2026-6838 +3 more

  GO-2026-6838: Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6841: Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo

  GO-2026-6844: Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests in github.com/labstack/echo

Jul 21, 2026 GO-2026-6838 +10 more

  GO-2026-6838: Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6841: Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo

  GO-2026-6844: Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

Jul 12, 2026 GO-2026-6838 +10 more

  GO-2026-6838: Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6841: Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo

  GO-2026-6844: Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

Jun 15, 2026 GO-2026-6838 +10 more

  GO-2026-6838: Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6841: Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo

  GO-2026-6844: Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

Jun 14, 2026 GO-2026-6838 +10 more

  GO-2026-6838: Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6841: Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo

  GO-2026-6844: Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

May 1, 2026 GO-2026-6293 +12 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6838: Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6841: Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo

  GO-2026-6844: Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Mar 31, 2026 GO-2026-6293 +13 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6838: Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6841: Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo

  GO-2026-6844: Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Feb 15, 2026 GO-2026-6293 +14 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6838: Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6841: Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo

  GO-2026-6844: Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Feb 6, 2026 GO-2026-6293 +14 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6838: Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6841: Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo

  GO-2026-6844: Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Feb 2, 2026 GO-2026-4502 +15 more

  GO-2026-4502: Echo has a Windows path traversal via backslash in middleware.Static default filesystem in github.com/labstack/echo/v5

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6838: Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6841: Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo

  GO-2026-6844: Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Jan 28, 2026 GO-2026-4502 +15 more

  GO-2026-4502: Echo has a Windows path traversal via backslash in middleware.Static default filesystem in github.com/labstack/echo/v5

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6838: Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6841: Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo

  GO-2026-6844: Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Jan 18, 2026 GO-2026-4502 +15 more

  GO-2026-4502: Echo has a Windows path traversal via backslash in middleware.Static default filesystem in github.com/labstack/echo/v5

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6838: Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6841: Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo

  GO-2026-6844: Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Changes in this version

+ func LoadBytes(t *testing.T, name string, opts ...loadBytesOpts) []byte

+ func TrimNewlineEnd(bytes []byte) []byte

+ type ContextConfig struct

+ FormValues url.Values

+ Headers http.Header

+ JSONBody []byte

+ MultipartForm *MultipartForm

+ PathValues echo.PathValues

+ QueryValues url.Values

+ Request *http.Request

+ Response *httptest.ResponseRecorder

+ RouteInfo *echo.RouteInfo

+ func (conf ContextConfig) ServeWithHandler(t *testing.T, handler echo.HandlerFunc, opts ...any) *httptest.ResponseRecorder

+ func (conf ContextConfig) ToContext(t *testing.T) *echo.Context

+ func (conf ContextConfig) ToContextRecorder(t *testing.T) (*echo.Context, *httptest.ResponseRecorder)

+ type MultipartForm struct

+ Fields map[string]string

+ Files []MultipartFormFile

+ type MultipartFormFile struct

+ Content []byte

+ Fieldname string

+ Filename string