zlacker

It's easier for a bad actor to get an exploit, than for an operator to test his own site if the upgrade succeded

>>rvnx+(OP)
An operator might not be able to upgrade at all!

Along the fixes, the advisories now need to contain detailed workarouds, firewall rules and other adhoc solutions to ensure they get quickly deployed.

>>_pdp_+a1
A guide for mitigation is way more useful so we can back port only the fix and test if the fix works.

>>_pdp_+a1
I tend to agree. Cloudflare and Vercel were able to mitigate in the form of WAF rules, but it's not immediately clear what a user or vendor can do to implement mitigations themselves other than updating their dependencies (quickly!).

IMO the CVE announcement could have been better handled. This was a level 10. If other mitigations can are viable and you know about them, you have a responsibility to disclose them in order to best protect the safety of the billions of users of React applications.

I wonder how many applications are still vulnerable.