CVE-2025-7339: on-headers vulnerable to http response header manipulation
Impact
A bug in on-headers versions < 1.1.0 may result in response headers being inadvertently modified when an array is passed to response.writeHead()
Patches
Users should upgrade to 1.1.0
Workarounds
Uses are encouraged to upgrade to 1.1.0, but this issue can be worked around by passing an object to response.writeHead() rather than an array.
Other sources
on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions <1.1.0 may result in response headers being inadvertently modified when an array is passed to response.writeHead(). Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to 1.1.0, but this issue can be worked around by passing an object to response.writeHead() rather than an array.
— NVD
on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions 1.1.0 may result in response headers being inadvertently modified when an array is passed to response.writeHead(). Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to 1.1.0, but this issue can be worked around by passing an object to response.writeHead() rather than an array.
— IBM
on-headers vulnerable to http response header manipulation
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7339?
The severity of CVE-2025-7339 is classified as moderate due to the potential for unintended modification of response headers.
How do I fix CVE-2025-7339?
To fix CVE-2025-7339, users should upgrade to on-headers version 1.1.0 or later.
What versions are affected by CVE-2025-7339?
CVE-2025-7339 affects on-headers versions prior to 1.1.0.
What type of bug is associated with CVE-2025-7339?
CVE-2025-7339 involves a bug that may lead to inadvertent modifications of response headers when an array is passed to response.writeHead().
Who is affected by CVE-2025-7339?
Users of on-headers versions prior to 1.1.0 are affected by CVE-2025-7339.