webpack-dev-server versions 5.2.5 and earlier crash the entire Node.js process when an unauthenticated client sends a normal HTTP request with a malformed Host header or attempts a WebSocket upgrade to the default /ws endpoint using a malformed Origin header. The malformed value triggers an uncaught exception in host- validation logic, terminating the development server. This flaw only affects availability; it does not disclose data or allow code execution.

The vulnerability affects all releases of webpack-dev-server up to and including 5.2.5. Any Node.js environment running the development server that is exposed to external traffic is potentially impacted. The issue is resolved in 5.2.6 and later, and keeping the server bound to localhost limits exposure to local developers.

An attacker needs only network access to the exposed development server and no authentication to trigger the crash. The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. If the server is reachable from untrusted networks, a crafted HTTP or WebSocket request with a malformed Host or Origin header can reliably cause the server to stop.