The vulnerability stemmed from improper handling of empty pathnames in WebSocket requests. The commit 0533a48 explicitly fixes this by adding a fallback to '/' when url.parse() returns a null pathname. The affected code in ToReceiveIncomingSailsIOMsg (in lib/receive-incoming-sails-io-msg.js) directly processes incoming messages and constructs the request object. The lack of input validation for pathname before the patch made this function vulnerable to type errors when handling malformed requests.