Node.js Brotli decoder out-of-bounds write permits remote code execution

Copying my comment from the Vercel post that gained no traction here:

> From what I can gather, Express 5's body-parser has Brotli decoding enabled by default which would make any endpoint with this middleware vulnerable to this. Am I mistaken?