The vulnerability lies in the open-editor endpoint of webpack-dev-server, where the Host header is incorrectly validated using a regular expression intended for browser Origin schemes. An unauthenticated attacker who can reach the development server can send a crafted Host value beginning with file: or an extension scheme, which bypasses the hostname and allowedHosts checks. This causes the endpoint to construct an invalid URL, raising an exception. In non‑production mode the server returns a 500 response containing the full exception stack trace, revealing absolute filesystem paths, module locations, and internal source line numbers. The impact is the disclosure of potentially sensitive information without causing service disruption.

Affected products include webpack-dev-server. Versions from 5.1.0 up to, but not including, 5.2.7, and version 6.0.0, are vulnerable. The issue is resolved in webpack-dev-server 5.2.7 and in 6.1.0 and later. Users of any affected releases should apply the corresponding upgrade.

The CVSS score of 5.3 indicates moderate severity, and the exploit is feasible over the network with no authentication required. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA KEV. Because the exploit path is simple—sending a single HTTP request from any network peer—the risk to environments that expose development servers to untrusted networks is significant. Upgrades or mitigations are advised promptly to prevent accidental disclosure of internal filesystem and code details.