Humm, will nginx enable header compression this time? Their HTTP/2 module disabled the hpack dynamic table, as I recall. Will they serve us again a poor-man QUIC and tell us "it's all fixed in the paid version" again?
IIRC wasn’t this due to security exploit (information leak) with compression enabled you can figure out what is in the headers by doing some kind of observation of the changes in byte sizes?
you're thinking of an exploit in spdy (the h2 predecessor) in which the headers were just run through the same gzip context. The HPACK format in h2 and h3 is meant to remove those oracles. (though it is less effective bytewise than gzip).
Is HTTP2 in the paid version different than the opensource implementation?