One more mitigation idea: set non-trivial expiration times and "prime" your caches. When you update a resource, hit all your CDN endpoints (at least ones which

One more mitigation idea: set non-trivial expiration times and "prime" your caches. When you update a resource, hit all your CDN endpoints (at least ones which don't follow spec and are known to be exploitable) to force them to download and cache the good copy. Bake it into your CI deployment process.