The vulnerability stems from line 274 of WebServer.js where decodeURIComponent() is directly applied to req.url. This function throws URIError when encountering invalid encoded URI components, which isn't caught by any try/catch block. Attackers can exploit this by sending specially crafted URLs with invalid encoding, causing unhandled exceptions that terminate the server process. The advisory explicitly references this line, and the lack of error handling around URI decoding is a well-known pattern for DoS vulnerabilities in Node.js servers.