The vulnerability stems from the line .split(new RegExp(boundary)) in the parse function. The boundary value is extracted directly from the HTTP request headers without sanitization, and converting it to a RegExp object enables ReDoS attacks via malicious boundary patterns. The patch replaces new RegExp(boundary) with a direct string split (split(boundary)), confirming this was the vulnerable code path. The parse function is the entry point for processing untrusted input and directly handles the dangerous regex construction.