A 500 response means something went wrong on the server side: an unhandled exception in the code, a crashed worker, a bad configuration or an exhausted resource. The client did nothing malformed in the protocol sense, and the server could not complete the job. Related codes include 502 Bad Gateway and 504 Gateway Timeout, which come from a proxy when the backend fails or is too slow.
A single 500 is normal. A burst of them from one address, or on one URL, is worth looking at. Attackers probing for a flaw often see an error as a hint that their input reached something fragile, and a crash that returns 500 can be the first sign of a memory corruption bug or a denial of service.
Users should not see details. A production site should show a plain error page and write the full stack trace to a log that only operators can read.
Watch the rate of 500s per endpoint, and when a particular request reliably produces one, read the server error log to find out why.