I don’t know about that specific software, but I would be surprised if it decoded message bodies, which is entirely unrelated to TLS termination and shouldd be entirely unrelated to routing. So I would expect you would still be vulnerable.
replyYep, I don't think too many people are exposing their python/node servers directly, it should be always behind a proxy or a fancy cloud LB.
replyApache and nginx don't handle brotli out of the box.
Your two sentences basically contradict one another, no? Apache doesn't handle brotli, so it will pass the compressed body to the underlying server undecoded, which means the underlying server is effectively exposed to attacks on this bug, if it does brotli decode on the body.
reply[dead]
reply