Analysis and Remediation Guidance of CSRF Vulnerability in Csurf Express.js Middleware

Technical Summary
On 28th of August fortbridge.co.uk reported a vulnerability in csurf middleware – expressjs supporting library that enables CSRF protection in expressjs.
As of 13th of September csurf library has been deprecated with no plans to fix the vulnerabilities.
There is no viable alternative for csurf middleware now.
Am I Affected?
All versions of csurf library are vulnerable if:
csurf is setup to use double-submit cookies – csurf({cookie: true})
and default value function is in use
 
Setting up cookie …

analysis csrf express guidance middleware remediation vulnerability