The nginx brotli module compresses outbound traffic. How would someone exploit brotli on nginx in this scenario? Is there PoC code that could be used against an nginx server that has the Brotli module enabled?
If you combine nginx brotli with nginx reverse proxy to a backend server that uses brotli-compressed responses, then you would have an opportunity for attack through this mechanism, assuming you could get your payload through both layers and back.
Just compress your POST request payload with it. The endpoint doesn't even have to accept POST requests