From what I can gather, Express 5's body-parser has Brotli decoding enabled by default which would make any endpoint with this middleware vulnerable to this. Am I mistaken?
I think brotli lives in the node library, and express only reaches through node zlib itself. you can say the door is express but house is node.