The vulnerability stems from improper path resolution when handling user-supplied URLs. The proof of concept (GET //etc/passwd) demonstrates that the server resolves absolute paths outside the intended root directory. In Node.js static file servers, this typically occurs in the request handler where the URL is directly mapped to the filesystem using path.join or path.resolve without checks for path traversal. The lack of normalization or validation against absolute paths or directory traversal sequences (e.g., ../) makes this function vulnerable. While the exact code isn't provided, the described behavior and common implementation patterns in static file servers justify high confidence in this assessment.