CVE-2026-27482: Incomplete Http Method Blocklistcve-2026-27482-incomplete-http-method-blocklist
Using a blocklist of HTTP methods (e.g., explicitly matching POST or PUT) to deny requests is prone to omissions. Methods like DELETE or PATCH may be inadvertently allowed, leading to CSRF or unintended modifications from untrusted origins. Use an allowlist of safe methods (e.g., GET, HEAD, OPTIONS) and deny all others instead.
