CVE-2025-7339CWE-241

on-headers vulnerable to http response header manipulation

Low · published July 17, 2025

CVSS v3.1
3.4
EPSS
0%
Percentile
10.3
In the wild
Unconfirmed
What it is

on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.

The record
Technical detail
CVSS v3.1
3.4 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00208 · 10.3th percentile
Weakness
CWE-241 · Improper Handling of Unexpected Data Type
Published
2025-07-17T15:47Z
EPSS history
Timeline
  • 17 JUL 15:47Z
    on-headers vulnerable to http response header manipulation
    cvelistv5