The vulnerability stems from the regex-based email validation in index.js. The commit diff shows the regex /^\S+@\S+$/ was used without input length validation, making it vulnerable to REDOS via long emails. The patch adds a 300-character limit before regex validation, confirming the original function's regex was the attack vector. The exported email validation function is the primary entry point for this check, making it the clear vulnerable component.