Hacker News new | past | comments | ask | show | jobs | submit
CJefferson | on: Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more
I can almost certainly make my browser submit its file upload POST with the compression of my choice and your server will accept it.
jgalt212 | parent
apache does not accept brotli by default. so while the first part is true, the second part is only true for some X% of websites.