methodOverride Middleware Reflected Cross-Site Scripting in connect

Description

Connect is a stack of middleware that is executed in order in each request.

The “methodOverride” middleware allows the http post to override the method of the request with the value of the “_method” post key or with the header “x-http-method-override”.

Because the user post input was not checked, req.method could contain any kind of value.

Recommendation

Update the connect package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.8.0
• Patched version(s): 2.8.1

References

• GHSA-3fw8-66wf-pr7m
• access.redhat.com
• bugzilla.redhat.com
• bugzilla.suse.com
• security-tracker.debian.org
• www.npmjs.com
• www.openwall.com
• CVE-2013-7370
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival - CVE-2025-59414
• Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS) - CVE-2025-8101
• Marked allows Regular Expression Denial of Service (ReDoS) attacks - CVE-2018-25110
• tarteaucitron.js allows url scheme injection via unfiltered inputs - CVE-2025-31476

Tags:

npm

connect