Conversation

hey all, there's a rash of http2 vulnerabilities going around c/o Netflix today.

the default mastodon nginx config has http2 enabled, and nginx is affected (in one form or another) to three of these attacks, so you should upgrade nginx as soon as possible:

https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/