Comment by sippeangelo

From what I can gather, Express 5's body-parser has Brotli decoding enabled by default which would make any endpoint with this middleware vulnerable to this. Am I mistaken?