The vulnerability stemmed from case-sensitive handling of ignored files. The security patch removed the core request handling logic in lib/server.js and directory rendering in lib/render.js, replacing them with serve-handler which properly handles case insensitivity. The removed serverHandler function contained the vulnerable ignore check using 'ignoredFiles.every(item => !decodeURIComponent(pathname).includes(item))' which performed case-sensitive matching. The renderDirectory function in render.js generated directory listings without case normalization, potentially exposing ignored files through case variations on case-insensitive filesystems.