Package

csurf

CSRF token middleware

v1.11.0, 19 Jan 2020MIT-Types: NoneHTTP servers and web frameworks Security

$ npm install csurf

npm GitHub Homepage

Deprecated on npm

This package is archived and no longer maintained. For support, visit https://github.com/expressjs/express/discussions

Key numbers

As of 25 Sept 2026

Weekly downloads: 322.6k; -11% over 12 months
Gzip bundle size: -; No Bundlephobia data
Dependencies: 4; Direct, from package.json
Last release: 6 years ago; v1.11.0
GitHub stars: -
Open issues / PRs: - / -
Contributors: -
Commits, last 52 weeks: -

Downloads

Last week 2026-09-15 to 2026-09-21

Weekly npm downloads, one point per week, weeks starting 23 Sept 2025 to 15 Sept 2026. The y axis starts at zero.

322,646 downloads last week, 1,552,352 in the last month. The 12-month change of -11% compares the average of the last 4 weeks with the first 4 weeks of the series.

Maintenance

Releases, last 12 months: 029 in total
Latest version: 1.11.0, 19 Jan 20206 years ago
First published: 15 May 2013
Last push to GitHub: -
Repository archived: -
Open issues: -
Open pull requests: -
Commits, last 52 weeks: -
Dependents on npm: -

Major versions

v1 first release 1.0.0, 5 Mar 2014
v0 first release 0.0.1, 15 May 2013

Recent releases

Version	Published
1.11.0	19 Jan 2020
1.10.0	23 Apr 2019
1.9.0	27 May 2016
1.8.3	11 Jun 2015
1.8.2	10 May 2015
1.8.1	4 May 2015
1.8.0	8 Apr 2015
1.7.0	15 Feb 2015
1.6.6	1 Feb 2015
1.6.5	9 Jan 2015
1.6.4	30 Dec 2014
1.6.3	9 Nov 2014
1.6.2	14 Oct 2014
1.6.1	6 Sept 2014

Compatibility

Module format: -Not determined from package.json
TypeScript types: None
Node.js engine range: >= 0.8.0
Runtimes: -
Unpacked size (npm): 23 kB
Dependencies (4): csrfcookiehttp-errorscookie-signature

Install

npm install csurf

CDN

jsDelivrhttps://cdn.jsdelivr.net/npm/csurf@1.11.0/
unpkghttps://unpkg.com/csurf@1.11.0/
esm.shhttps://esm.sh/csurf@1.11.0

Alternatives

Package	Weekly downloads	Gzip	Last release	Module	Comparison
csrf-csrf A utility package to help implement stateless CSRF protection using the Double Submit Cookie Pattern in express.	137.6k	-	1 year ago	ESM + CommonJS	-
csrf-sync A utility package to help implement stateful CSRF protection using the Synchroniser Token Pattern in express.	122.1k	-	1 year ago	ESM + CommonJS	-
@dr.pogodin/csurf CSRF token middleware for ExpressJS	19.3k	-	3 days ago	ESM only	-
@sailshq/csurf A fork of csurf with ongoing maintenance from the Sails core team	22.8k	-	1 year ago	-	-
express-mongo-sanitize Sanitize your express payload to prevent MongoDB operator injection.	202.9k	-	4 years ago	CommonJS	-
sectxt A Node.js Security.txt implementation	5.4k	-	5 years ago	CommonJS	-
helmet-crossdomain Set the X-Permitted-Cross-Domain-Policies header in Express apps	324.4k	-	7 years ago	CommonJS	-
pompelmi ClamAV for humans — scan any file and get back Clean, Malicious, or ScanError. No daemons. No cloud. No native bindings.	5.5k	-	4 months ago	ESM + CommonJS	-

Sources: npm registry, npm downloads API. Data fetched 25 Sept 2026.

Indexability: Not indexed (discovery only): deprecated; GitHub data not fetched yet.