Log in Start free

Vulnerability · Published Jul 17, 2025 · Assigned by openjs

CVE-2025-7339on-headers vulnerable to http response header manipulation

Low 3.4

In plain English

A low-severity security flaw in on-headers from jshttp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.4Low
Exploit odds (30 days)0.2%top 89.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-on-headersno fix listedDEBIAN-CVE-2025-7339
Debian:13node-on-headers1.0.2-4DEBIAN-CVE-2025-7339
Debian:14node-on-headers1.0.2-4DEBIAN-CVE-2025-7339
Ubuntu:22.04:LTSnode-on-headersno fix listedUBUNTU-CVE-2025-7339
Ubuntu:24.04:LTSnode-on-headersno fix listedUBUNTU-CVE-2025-7339
Ubuntu:25.10node-on-headersno fix listedUBUNTU-CVE-2025-7339
Ubuntu:26.04:LTSnode-on-headersno fix listedUBUNTU-CVE-2025-7339
Ubuntu:26.10node-on-headersno fix listedUBUNTU-CVE-2025-7339
npmon-headers1.1.0GHSA-76c9-3jph-rj3q

Affected products (as reported)

VendorProductVersions
jshttp on-headers 0 – before 1.1.0

Weakness: CWE-241 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

References