The vulnerability stems from improper response handling in the fake_response function. The GitHub commit dd7e642 shows removal of a try-catch block that called res.end() after writing headers. This dual termination attempt (from fake_response and subsequent error handlers) caused stream write-after-end errors. The SockJS protocol validation failed to properly sanitize the Upgrade header, allowing attackers to force this code path via crafted websocket upgrade requests to invalid endpoints.