CVE-2026-42551 is a high-severity (CVSS 7.5) CWE-436 vulnerability in flightphp/core. A fix is available for flightphp/core — see the affected versions and patch details below.
Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-42551.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
flightphp/coreReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Summary
Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter on any HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin.
Affected code
flight/net/Request.php (≈ lines 281-292):
public static function getMethod(): string
{
$method = self::getVar('REQUEST_METHOD', 'GET');
if (self::getVar('HTTP_X_HTTP_METHOD_OVERRIDE') !== '') {
$method = self::getVar('HTTP_X_HTTP_METHOD_OVERRIDE');
} elseif (isset($_REQUEST['_method']) === true) {
$method = $_REQUEST['_method'];
}
return strtoupper($method);
}
$_REQUEST aggregates $_GET and $_POST; on PHP runtimes with request_order=GPC it also includes $_COOKIE.
Proof of concept
GET /item/42?_method=DELETE HTTP/1.1
is dispatched as DELETE /item/42.
GET /item/42 HTTP/1.1
X-HTTP-Method-Override: DELETE
is also dispatched as DELETE /item/42.
Trivial CSRF vector (no JavaScript required):
<img src="https://victim.tld/item/42?_method=DELETE">
loaded on any attacker-controlled page triggers the destructive DELETE on page load, bypassing Same-Origin Policy (image loads are not blocked).
Reproduced against /poc4/item/42.
Impact
- GET → DELETE / PUT CSRF on any route registered for unsafe verbs.
- Bypass of authentication, CSRF token, or rate-limiting middleware that is gated only on POST/DELETE.
- CDN cache poisoning: the CDN caches the GET response body while the origin executed a DELETE.
Patch (fixed in 3.18.1, commit b8dd23a)
A new flight.allow_method_override setting controls both override vectors. Operators can set it to false to disable X-HTTP-Method-Override and _method entirely.
Credit
Discovered by @Rootingg.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | flightphp/core | all versions | 3.18.1composer require flightphp/core:^3.18.1 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for flightphp/core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update flightphp/core to 3.18.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-42551 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is CVE-2026-42551 in your dependencies?
Find it across Packagist, including transitive dependencies.