The flaw arises from a weakness in the 'IP' package for Node.js, which incorrectly identifies the IP address '127.0.0.1' as public and globally routable when expressed in octal notation.