The vulnerability stems from how user-controlled query parameters are processed: 1) parseNew handles raw URL parameters and passes them to SET 2) SET uses the parse function which splits keys into base/tokens using regex 3) When base is proto and tokens contain properties, this leads to prototype pollution. The PoC demonstrates this with ?proto[test]=test payload modifying Object.prototype. The code structure shown in BlackFan's analysis confirms the lack of prototype validation in property assignment paths.