Some specific token data passed to the minting functions may be crafted to exploit this edge behavior of the merkle proof contract and bypass verification.
The node is calculated here:
An explanation can be found on the OpenZeppelin contract:
MerkleProof.sol#L13-L16
Add a prefix to the node hash, so that it makes sure the length is always > 64 bytes.
