Collected research

NODE.JS CONNECT CSRF BYPASS ABUSING METHODOVERRIDE MIDDLEWARE

Nibble Security: Node.js Connect CSRF bypass abusing methodOverride middleware

In Node.js Connect and Express, middleware runs in declaration order, so registering csrf before methodOverride lets an attacker send a GET request carrying _method=POST or an x-http-method-override header. The CSRF middleware skips token checks on idempotent verbs, then methodOverride upgrades the request to POST, executing a state-changing action with no token.

Record

Document

Nibble Security: Node.js Connect CSRF bypass abusing methodOverride middleware

Published by

blog.nibblesec.org

Topic

Server

In the archive

• Collected in the 2014 research round

Related sources

• Connect CSRF middleware ordering rule

Tags

• csrf
• header-injection
• auth-bypass
• http
• nodejs
• express
• javascript
• mitigation
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of blog.nibblesec.org, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.