The vulnerability stems from the protocol normalization code in URI.js's parsing logic. The commit 6ea641c shows the critical fix was adding the 'i' flag to the protocol-matching regex pattern. Before this fix, the regex '/^(https?|ftp|wss?)?:[/\]*/' was case-sensitive, meaning mixed-case schemes wouldn't be properly normalized to lowercase. This allowed bypassing checks that relied on protocol casing (e.g., blocking 'http:' but not 'hTtP:'). The test case added in test/urls.js with 'hTTps://////attacker.com' demonstrates this attack vector. The vulnerable code path is in the URI parser's initial protocol handling stage.