webpack-dev-server versions 5.2.5 and earlier are vulnerable to a crash when an unauthenticated client sends a normal HTTP request with a malformed Host header or initiates a WebSocket upgrade to the default /ws endpoint using a malformed Origin header. The bad header value triggers an uncaught exception in the host-validation logic, causing the entire Node.js process that hosts the server to terminate. The flaw only affects the availability of the development server; it does not expose data or enable code execution.

The vulnerability applies to all releases of webpack-dev-server up to and including version 5.2.5. Affected deployments may be any Node.js environment that runs the development server and has it exposed to traffic. Upgrading to 5.2.6 or later removes the crash condition, while keeping the server bound to localhost (the default configuration) limits exposure to local developers only.

An attacker only requires network access to the exposed development server and no authentication to trigger the crash. The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. If the server is reachable from untrusted networks, a crafted HTTP or WebSocket request with a malformed Host or Origin header can reliably cause the server to stop.