The vulnerability stems from:

1. The currencyCheckRegex pattern in currency.js has inefficient regex constructs (nested optional groups and unbounded quantifiers)
2. The original parse function lacked input length validation before regex execution
3. The PoC demonstrates exploitation with a long string of 13337 tabs followed by '.', which would cause exponential regex evaluation time
4. The patch added a maxLength check (200 characters) before regex processing, confirming the root cause was unconstrained input size
5. CWE-1333 (Inefficient Regex) is explicitly listed, matching the described vulnerability mechanism