CVE-2026-118656

Name of the Vulnerable Software and Affected Versions Echo versions prior to 4.16.0 Echo versions prior to 5.4.0

Description An open redirect issue exists in the sanitizeURI() function when AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status. The function only inspects the first two bytes of a redirect target to determine if it is a local path. An attacker can bypass this guard by placing a control character, such as a TAB, before a separator pair. Because browsers strip control characters and normalize backslashes before parsing, a crafted Location header can redirect users to an attacker-controlled host. This can be exploited for phishing or stealing OAuth and SSO tokens.

Recommendations Update Echo to version 4.16.0 or later. Update Echo to version 5.4.0 or later. As a temporary workaround, use trailing slash middlewares without a RedirectCode to rewrite paths internally instead of redirecting. As a temporary workaround, reject request paths that contain control characters before they reach the trailing slash middlewares.