Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2025-7339
PUBLISHED
More InfoOfficial Page
Assigner-openjs
Assigner Org ID-ce714d77-add3-4f53-aff5-83d477b104bb
View Known Exploited Vulnerability (KEV) details
Published At-17 Jul, 2025 | 15:47
Updated At-17 Jul, 2025 | 20:24
Rejected At-
▼CVE Numbering Authority (CNA)
on-headers vulnerable to http response header manipulation

on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.

Affected Products
Vendor
jshttp
Product
on-headers
Default Status
unaffected
Versions
Affected
  • From 0 before 1.1.0 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-241CWE-241
Type: CWE
CWE ID: CWE-241
Description: CWE-241
Metrics
VersionBase scoreBase severityVector
3.13.4LOW
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Version: 3.1
Base score: 3.4
Base severity: LOW
Vector:
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://github.com/jshttp/on-headers/security/advisories/GHSA-76c9-3jph-rj3q
N/A
https://github.com/jshttp/on-headers/commit/c6e384908c9c6127d18831d16ab0bd96e1231867
N/A
https://cna.openjsf.org/security-advisories.html
N/A
https://github.com/expressjs/morgan/issues/315
N/A
https://github.com/jshttp/on-headers/issues/15
N/A
Hyperlink: https://github.com/jshttp/on-headers/security/advisories/GHSA-76c9-3jph-rj3q
Resource: N/A
Hyperlink: https://github.com/jshttp/on-headers/commit/c6e384908c9c6127d18831d16ab0bd96e1231867
Resource: N/A
Hyperlink: https://cna.openjsf.org/security-advisories.html
Resource: N/A
Hyperlink: https://github.com/expressjs/morgan/issues/315
Resource: N/A
Hyperlink: https://github.com/jshttp/on-headers/issues/15
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
Details not found