The vulnerability stems from the cookie parsing logic in the _authenticate method. The original code (pre-6.4.1) used a callback that ignored parsing errors (ignoreErr parameter), proceeding to access state[config.cookie] even when parsing failed. The commit 249ba17 fixed this by adding error handling to the cookie parsing callback. The stack trace in GitHub issue #171 directly points to line 540 in socket.js where the unhandled null state access occurs, confirming this function's role in the vulnerability.