The idea is to identify brotli encoding in the content-encoding header and block that on nginx. This shouldn't reach vulnerable brotli parser in node.

I hope my assets are not connecting to malicious servers, otherwise yes, I have a problem.