Should have definitely been Brotli2Shell, but Google ingeniously managed to dodge that bullet by having NodeJS come out with a fix before they did (others might call that accidental exposure), and then barely communicating about that with the broader community once they finally did. Here's a timeline of events[0] and here's me more broadly complaining about Google's stance[1]
[0] https://www.bugsink.com/blog/http2shell-timeline/
[1] https://news.ycombinator.com/item?id=50230362