CVE-2025-7339
on-headers vulnerable to http response header manipulation
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
on-headers vulnerable to http response header manipulation
on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.
Reserved 2025-07-07 | Published 2025-07-17 | Updated 2025-07-17 | Assigner openjsgithub.com/...eaders/security/advisories/GHSA-76c9-3jph-rj3q
github.com/...ommit/c6e384908c9c6127d18831d16ab0bd96e1231867
cna.openjsf.org/security-advisories.html
github.com/expressjs/morgan/issues/315
github.com/jshttp/on-headers/issues/15
Support options
