p PatchFirst

CVE-2025-7339

CVE-2025-7339 · on-headers vulnerable to http response header manipulation

This page contains facts from public vulnerability sources. Check the original advisory before updating.

on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.

CVSS 3.4 · Low · EPSS 0.2% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • on-headers

    Versions
    • ≥ 0, < 1.1.0: Affected (semver)

    Update to 1.1.0

  • node-on-headers Debian:12

    Versions
    • 1.0.2-2
    • 1.0.2-4
    • 1.1.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-on-headers Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.0.2-4

    Update to 1.0.2-4

  • node-on-headers Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.0.2-4

    Update to 1.0.2-4

  • on-headers npm

    Affected ranges
    • SEMVER: < 1.1.0

    Update to 1.1.0

  • node-on-headers Ubuntu:16.04:LTS

    Versions
    • 1.0.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-on-headers Ubuntu:18.04:LTS

    Versions
    • 1.0.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-on-headers Ubuntu:20.04:LTS

    Versions
    • 1.0.1-1
    • 1.0.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-on-headers Ubuntu:22.04:LTS

    Versions
    • 1.0.2-1
    • 1.0.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-on-headers Ubuntu:24.04:LTS

    Versions
    • 1.0.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-on-headers Ubuntu:25.10

    Versions
    • 1.0.2-2
    • 1.0.2-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-on-headers Ubuntu:26.10

    Versions
    • 1.0.2-4
    • 1.1.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-on-headers Ubuntu:26.04:LTS

    Versions
    • 1.0.2-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →