I'll start with a working deserialization payload for the Node blog application on NodeBlog, and figure out what characters are breaking the payload when not encoded, and come to an unexpected conclusion.
Blog post for the box: https://0xdf.gitlab.io/2022/01/10/htb...