The vulnerability stems from how regex patterns are generated for routes with multiple parameters in a single segment. The commit diff shows critical changes in index.js's _on() and findRoute() methods, where regexps.push('(.*?)') was replaced with backtrack-aware patterns. These functions previously created non-atomic greedy quantifiers that allowed exponential backtracking when parameters were separated by hyphens. The CWE-1333 classification and test case changes confirming parameter parsing behavior further validate this analysis.