3 ms·
An operator might not be able to upgrade at all! Along the fixes, the advisories now need to contain detailed workarouds, firewall rules and other adhoc soluti
by _pdp_ 11mo ago
An operator might not be able to upgrade at all!
Along the fixes, the advisories now need to contain detailed workarouds, firewall rules and other adhoc solutions to ensure they get quickly deployed.
- rvnx 11mo agoA guide for mitigation is way more useful so we can back port only the fix and test if the fix works.
- seanw265 11mo agoI tend to agree. Cloudflare and Vercel were able to mitigate in the form of WAF rules, but it's not immediately clear what a user or vendor can do to implement mitigations themselves other than updating their dependencies (quickly!). IMO the CVE announcement could have been better handled. This was a level 10. If other mitigations can are viable and you know about them, you have a responsibility to disclose them in order to best protect the safety of the billions of users of React applications. I wonder how many applications are still vulnerable.