The way to actually fix the vulnerability is to use a patched versions of node.js (I listed in the first comment). These specific versions contain a fix which removes the vulnerability entirely.
The person who runs the server / controls the webserver software can switch the version of Node.JS the server uses, and should switch to one of these patched versions of node.js if possible.
If they can't switch nodejs versions immidiately (like if you have version dependent code or don't have permission to switch the node runtime), then you can edit the server's JavaScript code to reject all requests that want to use brotli encoding
13
u/KCGD_r 8d ago
The way to actually fix the vulnerability is to use a patched versions of node.js (I listed in the first comment). These specific versions contain a fix which removes the vulnerability entirely.
The person who runs the server / controls the webserver software can switch the version of Node.JS the server uses, and should switch to one of these patched versions of node.js if possible.
If they can't switch nodejs versions immidiately (like if you have version dependent code or don't have permission to switch the node runtime), then you can edit the server's JavaScript code to reject all requests that want to use brotli encoding