New HTTP QUERY Method Could Bypass Web Defences and Caches

In June 2026, the IETF published RFC 10008, defining QUERY, the first new standard HTTP method since PATCH in 2010. QUERY is intended to sit between GET and POST: it is safe, idempotent and cacheable, but places the query in the request body rather than the URL. Servers can advertise supported body formats using the Accept-Query response header.

The security concern is inconsistent support across existing infrastructure. Web application firewalls, API gateways, CSRF middleware, caches and load balancers may recognise only established methods and therefore handle QUERY unpredictably. The article says researchers found nginx’s limit_except pattern and Django’s View class reject it, while curl, FastAPI, Caddy and Traefik pass it through. nginx forwards QUERY but does not cache it, meaning repeated requests reach the backend.

Apache requires configuration changes, while Spring is initially limiting support. A WAF that inspects POST bodies for SQL injection, cross-site scripting or command injection but ignores QUERY bodies could potentially be bypassed. Cache poisoning and unintended side effects are also possible if systems rely on incomplete method assumptions, although the article does not report confirmed attacks.

The recommended response is to review and update method allowlists, regular expressions, WAF inspection rules, cache keys and CSRF controls to account for QUERY, and to compare how identical POST and QUERY payloads are handled. The author found no QUERY requests in their HTTP logs. They assess that malware detection based on beacon timing, traffic volume, TLS fingerprints and other behavioural indicators is largely unaffected; encrypted traffic also hides the method from sensors without TLS interception.