CVE-2025-7339
Low
Description
on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.
SeverityLow
CVSS3.4
Exploit probability—
ProductOn-headers
PublishedJul 17, 2025
First seenJul 17, 2025
Weakness typeCWE-241CWE-241
How to fix
Update
- on-headers1.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| on-headersnpm | v < 1.1.0 | 1.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.