diff --git a/src/controllers/404.js b/src/controllers/404.js
index 64802ffadb..0daafd583e 100644
--- a/src/controllers/404.js
+++ b/src/controllers/404.js
@@ -43,6 +43,7 @@ exports.send404 = async function (req, res) {
 	if (res.locals.isAPI) {
 		return res.json({ path: validator.escape(path.replace(/^\/api/, '')), title: '[[global:404.title]]' });
 	}
+	await middleware.applyCSRFasync(req, res);
 	await middleware.buildHeaderAsync(req, res);
 	res.render('404', { path: validator.escape(path), title: '[[global:404.title]]' });
 };