A New HTTP Verb Lurks in the Shadows: What It Means for Web Security
In June 2026, the Internet Engineering Task Force (IETF) published RFC 10008, introducing a new HTTP method called “QUERY”. This new verb sits between GET and POST, allowing a request body to be included alongside the URL. While it’s designed to be safe and idempotent, like GET, its similarity to POST poses significant challenges for web security.
QUERY is being used in some applications, but most infrastructure controls were written before this method existed. Web Application Firewalls (WAFs), API gateways, CSRF middleware, cache keying, and load balancer method handling all rely on a set of known verbs: GET, POST, PUT, DELETE, and PATCH. The introduction of a new verb that behaves like a hybrid of the first two creates inconsistencies in behavior.
Researchers have found that different systems handle QUERY requests differently. Some, like nginx and Django’s View class, reject it outright, while others, such as curl, FastAPI’s explicit routes, Caddy, and Traefik, pass it through untouched. Even caching is inconsistent: one researcher found that nginx forwards QUERY requests but never caches them.
This new method also creates a vulnerability in WAF signatures. Many of these signatures are bound to “POST” bodies, ignoring the possibility of a body on a “QUERY” request. A malicious payload can be sent over both methods and will only trigger a security alert if it’s not cached or if the WAF is updated to recognize QUERY.
The use of QUERY also creates the potential for CSRF (Cross-Site Request Forgery) attacks. CSRF middleware that relies on state-changing verbs like POST may allow unintended side effects when dealing with safe and idempotent methods like GET and QUERY.
Some systems already support QUERY, including curl, Node.js/fetch, Python’s httpx/requests, Go net/http, and Rust reqwest. However, browser fetch/XHR can send it but doesn’t cache it due to CORS restrictions. Servers and proxies also exhibit inconsistent behavior: nginx proxies but never caches, while Caddy and Traefik pass it through untouched.
As QUERY becomes more widely used, security teams need to update their rules and regexes to support the new verb. This includes updating WAF signatures to recognize QUERY requests and caching mechanisms to handle its cacheable nature.
In conclusion, the introduction of the QUERY method creates new challenges for web security. As this new HTTP verb gains traction, security teams must adapt their controls to account for its unique characteristics and potential vulnerabilities.
Source: SANS ISC — 2026-09-19