The vulnerability stems from two key issues in middleware.js: 1) The fetch call followed redirects automatically (default behavior) by not setting 'redirect: manual', enabling SSRF through malicious 3xx responses. 2) Lack of Location header processing allowed internal redirect targets. The patch added both redirect:manual and Location header sanitization, confirming these were the vulnerable points. The middleware's request proxying function is the entry point for SSRF exploitation.