The vulnerability stems from improper handling of proto and constructor properties during JSON object parsing. The security patch adds regex-based detection (suspectProtoRx/suspectConstructorRx) and validation logic in the object() function within lib/parse.js. In vulnerable versions (<1.0.0), this function would process these dangerous properties without checks, enabling prototype pollution. The runtime detection would show the object parsing function being called with malicious keys, as this is where the unsafe property assignment occurred before mitigation.