Merge commit from fork

* fix(middleware): bound v4 body dumps without truncating requests

Default request and response capture to 5 MiB with configurable opt-outs. Replay captured request bytes before the remaining original stream and preserve read errors and Close ownership. Cover bounded captures, full payload delivery, and BodyLimit composition.

Addresses GHSA-f48p-c9v4-h7xv. Request replay follows the v5 contribution in PR 3105.

Co-authored-by: Jake Wang <jake.wang@argonlabs.tech>

* fix(middleware): limit v4 decompressed request sizes

Apply a configurable 100 MiB decompression cap and return HTTP 413 for excess data. Accept exact-limit bodies, retain overflow errors on repeated reads, and clear compressed ContentLength metadata. Cover defaults, opt-outs, boundaries, and streaming compressed expansion.

Addresses GHSA-h7wr-284f-5qvc. Boundary handling follows the v5 contribution in PR 3136.

Co-authored-by: Shubham Padkonde <shubhampadkonde12@gmail.com>

* fix(middleware): validate v4 proxy upgrades and close disconnected tunnels

Backport the v5 standard reverse-proxy handling, WebSocket disconnect cleanup, ws/wss target normalization, and Forwarded-header removal. Cover rejected and accepted upgrades, both disconnect directions, and protocol mismatch.

Addresses GHSA-cxf3-9h37-7rr8, GHSA-9969-6676-49h5, and hardens GHSA-6gpx-gjwr-mhp8.

* fix(deps): update v4 HTTP/2 dependencies and require Go 1.26

Upgrade golang.org/x/net to v0.60.0 and its required crypto, sys, and text versions to remediate reachable HTTP/2 advisories. Match the supported CI matrix to Go 1.26 and 1.27. Preserve the existing StartH2CServer API with narrow deprecation annotations.

* test(middleware): verify v4 WebSocket transport and response hooks

* fix(middleware): close v4 WebSocket backends that ignore client EOF

Disable backend half-close after the response hook, matching frontend handling, for WebSocket upgrades. Add the review regression with an upstream that stays open after reading client EOF; the proxy must finish independently.

* test(middleware): verify v4 decompression limits through JSON and XML binding

Confirm that Bind preserves ErrStatusRequestEntityTooLarge and the default error handler returns HTTP 413 for both formats. This disproves the review claim that these paths turn the limit into HTTP 400.

---------

Co-authored-by: Jake Wang <jake.wang@argonlabs.tech>
Co-authored-by: Shubham Padkonde <shubhampadkonde12@gmail.com>

Author: 3 people

.github/workflows/checks.yml

@@ -16,7 +16,7 @@ permissions:
 
 env:
   # run static analysis only with the latest Go version
-  LATEST_GO_VERSION: "1.26"
+  LATEST_GO_VERSION: "1.27"
 
 jobs:
   check:

.github/workflows/echo.yml

@@ -16,7 +16,7 @@ permissions:
 
 env:
   # run coverage and benchmarks only with the latest Go version
-  LATEST_GO_VERSION: "1.26"
+  LATEST_GO_VERSION: "1.27"
 
 jobs:
   test:
@@ -27,7 +27,7 @@ jobs:
         # Echo tests with last four major releases (unless there are pressing vulnerabilities)
         # As we depend on `golang.org/x/` libraries which only support the last 2 Go releases, we could have situations when
         # we derive from the last four major releases promise.
-        go: ["1.25", "1.26"]
+        go: ["1.26", "1.27"]
     name: ${{ matrix.os }} @ Go ${{ matrix.go }}
     runs-on: ${{ matrix.os }}
     steps:

echo.go

@@ -860,6 +860,8 @@ func (e *Echo) TLSListenerAddr() net.Addr {
 }
 
 // StartH2CServer starts a custom http/2 server with h2c (HTTP/2 Cleartext).
+//
+//lint:ignore SA1019 Preserve the v4 public API through its supported lifetime; x/net remains security patched.
 func (e *Echo) StartH2CServer(address string, h2s *http2.Server) error {
 	e.startupMutex.Lock()
 	// Setup

echo_test.go

@@ -1195,6 +1195,7 @@ func TestEcho_StartH2CServer(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			e := New()
 			e.Debug = true
+			//lint:ignore SA1019 Exercise the supported v4 StartH2CServer API.
 			h2s := &http2.Server{}
 
 			errChan := make(chan error)

go.mod

@@ -1,13 +1,13 @@
 module github.com/labstack/echo/v4
 
-go 1.25.0
+go 1.26.0
 
 require (
 	github.com/labstack/gommon v0.5.0
 	github.com/stretchr/testify v1.11.1
 	github.com/valyala/fasttemplate v1.2.2
-	golang.org/x/crypto v0.53.0
-	golang.org/x/net v0.56.0
+	golang.org/x/crypto v0.57.0
+	golang.org/x/net v0.60.0
 	golang.org/x/time v0.15.0
 )
 
@@ -17,7 +17,7 @@ require (
 	github.com/mattn/go-isatty v0.0.22 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -14,14 +14,14 @@ github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6Kllzaw
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
 github.com/valyala/fasttemplate v1.2.2 h1:lxLXG0uE3Qnshl9QyaK6XJxMXlQZELvChBOCmQD0Loo=
 github.com/valyala/fasttemplate v1.2.2/go.mod h1:KHLXt3tVN2HBp8eijSv/kGJopbvo7S+qRAEEKiv+SiQ=
-golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
-golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=

middleware/body_dump.go

@@ -22,6 +22,14 @@ type BodyDumpConfig struct {
 	// Handler receives request and response payload.
 	// Required.
 	Handler BodyDumpHandler
+
+	// MaxRequestBytes limits captured request bytes, without truncating the body
+	// delivered to the next handler. Defaults to 5 MiB; -1 disables the limit.
+	MaxRequestBytes int64
+
+	// MaxResponseBytes limits captured response bytes, without truncating the
+	// response delivered to the client. Defaults to 5 MiB; -1 disables the limit.
+	MaxResponseBytes int64
 }
 
 // BodyDumpHandler receives the request and response payload.
@@ -57,6 +65,12 @@ func BodyDumpWithConfig(config BodyDumpConfig) echo.MiddlewareFunc {
 	if config.Skipper == nil {
 		config.Skipper = DefaultBodyDumpConfig.Skipper
 	}
+	if config.MaxRequestBytes == 0 {
+		config.MaxRequestBytes = 5 * 1024 * 1024
+	}
+	if config.MaxResponseBytes == 0 {
+		config.MaxResponseBytes = 5 * 1024 * 1024
+	}
 
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) (err error) {
@@ -67,17 +81,30 @@ func BodyDumpWithConfig(config BodyDumpConfig) echo.MiddlewareFunc {
 			// Request
 			reqBody := []byte{}
 			if c.Request().Body != nil {
+				originalBody := c.Request().Body
+				var reader io.Reader = originalBody
+				if config.MaxRequestBytes > 0 {
+					reader = io.LimitReader(reader, config.MaxRequestBytes)
+				}
 				var readErr error
-				reqBody, readErr = io.ReadAll(c.Request().Body)
+				reqBody, readErr = io.ReadAll(reader)
 				if readErr != nil {
 					return readErr
 				}
+				c.Request().Body = struct {
+					io.Reader
+					io.Closer
+				}{Reader: io.MultiReader(bytes.NewReader(reqBody), originalBody), Closer: originalBody}
+			} else {
+				c.Request().Body = http.NoBody
 			}
-			c.Request().Body = io.NopCloser(bytes.NewBuffer(reqBody)) // Reset
 
 			// Response
 			resBody := new(bytes.Buffer)
-			mw := io.MultiWriter(c.Response().Writer, resBody)
+			var mw io.Writer = io.MultiWriter(c.Response().Writer, resBody)
+			if config.MaxResponseBytes > 0 {
+				mw = &bodyDumpLimitedWriter{writer: c.Response().Writer, buffer: resBody, remaining: config.MaxResponseBytes}
+			}
 			writer := &bodyDumpResponseWriter{Writer: mw, ResponseWriter: c.Response().Writer}
 			c.Response().Writer = writer
 
@@ -93,6 +120,22 @@ func BodyDumpWithConfig(config BodyDumpConfig) echo.MiddlewareFunc {
 	}
 }
 
+type bodyDumpLimitedWriter struct {
+	writer    io.Writer
+	buffer    *bytes.Buffer
+	remaining int64
+}
+
+func (w *bodyDumpLimitedWriter) Write(p []byte) (int, error) {
+	n, err := w.writer.Write(p)
+	if w.remaining > 0 {
+		captured := min(int64(n), w.remaining)
+		_, _ = w.buffer.Write(p[:captured])
+		w.remaining -= captured
+	}
+	return n, err
+}
+
 func (w *bodyDumpResponseWriter) WriteHeader(code int) {
 	w.ResponseWriter.WriteHeader(code)
 }

middleware/body_dump_limits_test.go

@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 LabStack LLC and Echo contributors
+
+package middleware
+
+import (
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"testing/iotest"
+
+	"github.com/labstack/echo/v4"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBodyDumpCaptureLimits(t *testing.T) {
+	for _, tc := range []struct {
+		name                   string
+		reqLimit, resLimit     int64
+		size, reqWant, resWant int
+	}{
+		{"configured", 3, 4, 8, 3, 4},
+		{"exact", 8, 8, 8, 8, 8},
+		{"unlimited", -1, -1, 8, 8, 8},
+		{"default", 0, 0, 6 << 20, 5 << 20, 5 << 20},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			payload := strings.Repeat("x", tc.size)
+			var requestDump, responseDump []byte
+			e := echo.New()
+			e.Use(BodyDumpWithConfig(BodyDumpConfig{MaxRequestBytes: tc.reqLimit, MaxResponseBytes: tc.resLimit,
+				Handler: func(_ echo.Context, req, res []byte) { requestDump, responseDump = req, res }}))
+			e.POST("/", func(c echo.Context) error {
+				body, err := io.ReadAll(c.Request().Body)
+				if err != nil {
+					return err
+				}
+				require.Equal(t, payload, string(body))
+				return c.String(http.StatusOK, string(body))
+			})
+			rec := httptest.NewRecorder()
+			e.ServeHTTP(rec, httptest.NewRequest(http.MethodPost, "/", strings.NewReader(payload)))
+			require.Equal(t, http.StatusOK, rec.Code)
+			require.Equal(t, payload, rec.Body.String())
+			require.Equal(t, payload[:tc.reqWant], string(requestDump))
+			require.Equal(t, payload[:tc.resWant], string(responseDump))
+		})
+	}
+}
+
+type bodyDumpCloseTracker struct {
+	io.Reader
+	closed bool
+}
+
+func (b *bodyDumpCloseTracker) Close() error { b.closed = true; return nil }
+
+func TestBodyDumpPreservesRemainderErrorAndClose(t *testing.T) {
+	wantErr := errors.New("remainder failed")
+	body := &bodyDumpCloseTracker{Reader: io.MultiReader(strings.NewReader("abcdefgh"), iotest.ErrReader(wantErr))}
+	req := httptest.NewRequest(http.MethodPost, "/", nil)
+	req.Body = body
+	e := echo.New()
+	c := e.NewContext(req, httptest.NewRecorder())
+	var dumped []byte
+	err := BodyDumpWithConfig(BodyDumpConfig{MaxRequestBytes: 3, Handler: func(_ echo.Context, req, res []byte) { dumped = req }})(func(c echo.Context) error {
+		require.False(t, body.closed)
+		data, err := io.ReadAll(c.Request().Body)
+		require.Equal(t, "abcdefgh", string(data))
+		require.ErrorIs(t, err, wantErr)
+		require.NoError(t, c.Request().Body.Close())
+		require.True(t, body.closed)
+		return err
+	})(c)
+	require.ErrorIs(t, err, wantErr)
+	require.Equal(t, "abc", string(dumped))
+}

middleware/body_dump_security_test.go

@@ -0,0 +1,71 @@
+// SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: © 2026 LabStack LLC and Echo contributors
+
+package middleware
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/labstack/echo/v4"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBodyDumpPreservesBodyLimit(t *testing.T) {
+	for _, dumpFirst := range []bool{false, true} {
+		for _, knownLength := range []bool{false, true} {
+			t.Run(fmt.Sprintf("dumpFirst=%t/knownLength=%t", dumpFirst, knownLength), func(t *testing.T) {
+				e := echo.New()
+				dump := BodyDumpWithConfig(BodyDumpConfig{MaxRequestBytes: 4, Handler: func(echo.Context, []byte, []byte) {}})
+				limit := BodyLimit("5")
+				if dumpFirst {
+					e.Use(dump, limit)
+				} else {
+					e.Use(limit, dump)
+				}
+				accepted := false
+				e.POST("/", func(c echo.Context) error {
+					if _, err := io.ReadAll(c.Request().Body); err != nil {
+						return err
+					}
+					accepted = true
+					return c.NoContent(http.StatusOK)
+				})
+				req := httptest.NewRequest(http.MethodPost, "/", strings.NewReader("ABCDEFGH"))
+				if !knownLength {
+					req.ContentLength = -1
+					req.TransferEncoding = []string{"chunked"}
+				}
+				rec := httptest.NewRecorder()
+				e.ServeHTTP(rec, req)
+				require.Equal(t, http.StatusRequestEntityTooLarge, rec.Code)
+				require.False(t, accepted)
+			})
+		}
+	}
+}
+
+func TestBodyDumpPreservesBodyLimitChunkedHTTP(t *testing.T) {
+	e := echo.New()
+	e.Use(BodyLimit("5"), BodyDumpWithConfig(BodyDumpConfig{MaxRequestBytes: 4, Handler: func(echo.Context, []byte, []byte) {}}))
+	e.POST("/", func(c echo.Context) error {
+		body, err := io.ReadAll(c.Request().Body)
+		if err != nil {
+			return err
+		}
+		return c.String(http.StatusOK, string(body))
+	})
+	server := httptest.NewServer(e)
+	defer server.Close()
+	req, err := http.NewRequest(http.MethodPost, server.URL, io.NopCloser(strings.NewReader("ABCDEFGH")))
+	require.NoError(t, err)
+	req.TransferEncoding = []string{"chunked"}
+	response, err := server.Client().Do(req)
+	require.NoError(t, err)
+	defer response.Body.Close()
+	require.Equal(t, http.StatusRequestEntityTooLarge, response.StatusCode)
+}

middleware/decompress.go

@@ -19,6 +19,10 @@ type DecompressConfig struct {
 
 	// GzipDecompressPool defines an interface to provide the sync.Pool used to create/store Gzip readers
 	GzipDecompressPool Decompressor
+
+	// MaxDecompressedSize limits the decompressed body in bytes. Reading beyond
+	// the limit returns HTTP 413. Defaults to 100 MiB; -1 disables the limit.
+	MaxDecompressedSize int64
 }
 
 // GZIPEncoding content-encoding header if set to "gzip", decompress body contents.
@@ -57,6 +61,9 @@ func DecompressWithConfig(config DecompressConfig) echo.MiddlewareFunc {
 	if config.GzipDecompressPool == nil {
 		config.GzipDecompressPool = DefaultDecompressConfig.GzipDecompressPool
 	}
+	if config.MaxDecompressedSize == 0 {
+		config.MaxDecompressedSize = 100 * 1024 * 1024
+	}
 
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		pool := config.GzipDecompressPool.gzipDecompressPool()
@@ -90,9 +97,43 @@ func DecompressWithConfig(config DecompressConfig) echo.MiddlewareFunc {
 			// only Close gzip reader if it was set to a proper gzip source otherwise it will panic on close.
 			defer gr.Close()
 
-			c.Request().Body = gr
+			if config.MaxDecompressedSize > 0 {
+				c.Request().Body = &limitedGzipReader{Reader: gr, remaining: config.MaxDecompressedSize}
+			} else {
+				c.Request().Body = gr
+			}
+			c.Request().ContentLength = -1
 
 			return next(c)
 		}
 	}
 }
+
+type limitedGzipReader struct {
+	*gzip.Reader
+	remaining int64
+}
+
+func (r *limitedGzipReader) Read(p []byte) (int, error) {
+	if len(p) == 0 {
+		return 0, nil
+	}
+	if r.remaining < 0 {
+		return 0, echo.ErrStatusRequestEntityTooLarge
+	}
+	if r.remaining == 0 {
+		var probe [1]byte
+		n, err := r.Reader.Read(probe[:])
+		if n > 0 {
+			r.remaining = -1
+			return 0, echo.ErrStatusRequestEntityTooLarge
+		}
+		return 0, err
+	}
+	if int64(len(p)) > r.remaining {
+		p = p[:r.remaining]
+	}
+	n, err := r.Reader.Read(p)
+	r.remaining -= int64(n)
+	return n, err
+}