From e864c36ec248311ae6a2d42d3d6e5bbda98e1e45 Mon Sep 17 00:00:00 2001
From: Abdullah Alqahtani <61029571+anqorithm@users.noreply.github.com>
Date: Mon, 2 Nov 2026 22:59:22 +0100
Subject: [PATCH] fix(middleware): reject negative Recover stack sizes

---
 middleware/recover.go      | 4 ++++
 middleware/recover_test.go | 7 +++++++
 2 files changed, 11 insertions(+)

diff --git a/middleware/recover.go b/middleware/recover.go
index 01fde5152..0680f06df 100644
--- a/middleware/recover.go
+++ b/middleware/recover.go
@@ -4,6 +4,7 @@
 package middleware
 
 import (
+	"errors"
 	"fmt"
 	"net/http"
 	"runtime"
@@ -51,6 +52,9 @@ func RecoverWithConfig(config RecoverConfig) echo.MiddlewareFunc {
 
 // ToMiddleware converts RecoverConfig to middleware or returns an error for invalid configuration
 func (config RecoverConfig) ToMiddleware() (echo.MiddlewareFunc, error) {
+	if config.StackSize < 0 {
+		return nil, errors.New("stack size must not be negative")
+	}
 	// Defaults
 	if config.Skipper == nil {
 		config.Skipper = DefaultRecoverConfig.Skipper
diff --git a/middleware/recover_test.go b/middleware/recover_test.go
index 719e0cc3d..8e0969d87 100644
--- a/middleware/recover_test.go
+++ b/middleware/recover_test.go
@@ -148,3 +148,10 @@ func TestRecoverWithConfig(t *testing.T) {
 		})
 	}
 }
+
+func TestRecover_NegativeStackSize(t *testing.T) {
+	middleware, err := (RecoverConfig{StackSize: -1}).ToMiddleware()
+	assert.Error(t, err)
+	assert.Nil(t, middleware)
+	assert.Panics(t, func() { RecoverWithConfig(RecoverConfig{StackSize: -1}) })
+}