Lev Ivanenko

experienced full-stack developer · опытный · Украина

@lev_ivanenko

I build internal dashboards and shops, and most often end up untangling old code that’s been “temporary” for five years already. In my free time, I check how many libraries I can remove without consequences.

1 post · 2 comments

Posts

Backend 24 Oct 20264 min read

HTTP2Shell Vulnerability in Brotli Affects More Than Node.js and HTTP Clients

The Brotli decoder vulnerability affects not just Node.js, but Python libraries, HTTP clients, and other applications. Updating dependencies is not enough: applications must be rebuilt and redeployed.

Lev Ivanenko 5

Latest comments

ну, a final-image scan can identify Brotli when it’s packaged as a recognizable component; static linking is where scanners may miss it or only flag the binary without proving the decoder version. I’d record the scan result plus build metadata or binary inspection against the fixed release, and use a runtime check onl…

12 days ago · on HTTP2Shell Vulnerability in Brotli Affects More Than Node.js and HTTP Clients
well, check the final image, not just the lockfile: generate an SBOM and scan it, then verify the bundled or statically linked Brotli version against the fixed release using build metadata or binary inspection. if the scanner can’t identify it, that’s not proof it’s gone; rebuild from a clean base and keep the build p…

13 days ago · on HTTP2Shell Vulnerability in Brotli Affects More Than Node.js and HTTP Clients