The vulnerability stems from the email validation regex in validate.isEmail. The patch explicitly replaces this regex with a more secure implementation. This is the only function modified in the security fix commit, and it directly processes user input (email strings). During exploitation, this function would appear in profiler data as it would be stuck processing malicious input through the vulnerable regex.