CVE-2025-7339
on-headers vulnerable to http response header manipulation
on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions <1.1.0 may result in response headers being inadvertently modified when an array is passed to response.writeHead(). Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to 1.1.0, but this issue can be worked around by passing an object to response.writeHead() rather than an array.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
on-headers vulnerable to http response header manipulation
on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions <1.1.0 may result in response headers being inadvertently modified when an array is passed to response.writeHead(). Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to 1.1.0, but this issue can be worked around by passing an object to response.writeHead() rather than an array.
- Record
CVE-2025-7339- CVSS 3.1
- 3.4 Low
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-241
- Updated
- 2026-11-02
EUVDEUVD-2025-21784
on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions <1.1.0 may result in response headers being inadvertently modified when an array is passed to response.writeHead(). Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to 1.1.0, but this issue can be worked around by passing an object to response.writeHead() rather than an array.
- Record
EUVD-2025-21784- CVSS 3.1
- 3.4 Low
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-76c9-3jph-rj3q
on-headers is vulnerable to http response header manipulation
Impact
A bug in on-headers versions < 1.1.0 may result in response headers being inadvertently modified when an array is passed to response.writeHead()
Patches
Users should upgrade to 1.1.0
Workarounds
Uses are encouraged to upgrade to 1.1.0, but this issue can be worked around by passing an object to response.writeHead() rather than an array.
- Record
GHSA-76c9-3jph-rj3q- CVSS 3.1
- 3.4 Low
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-241
- Updated
- 2026-11-02
NVD
on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions <1.1.0 may result in response headers being inadvertently modified when an array is passed to response.writeHead(). Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to 1.1.0, but this issue can be worked around by passing an object to response.writeHead() rather than an array.
- Record
CVE-2025-7339- CVSS 3.1
- 3.4 Low
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-241
- Updated
- 2026-11-02
OSV
on-headers vulnerable to http response header manipulation
on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions <1.1.0 may result in response headers being inadvertently modified when an array is passed to response.writeHead(). Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to 1.1.0, but this issue can be worked around by passing an object to response.writeHead() rather than an array.
- Record
CVE-2025-7339- CVSS 3.1
- 3.4 Low
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-241
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-7339
on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions <1.1.0 may result in response headers being inadvertently modified when an array is passed to response.writeHead(). Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to 1.1.0, but this issue can be worked around by passing an object to response.writeHead() rather than an array.
- Record
DEBIAN-CVE-2025-7339- CVSS 3.1
- 3.4 Low
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-76c9-3jph-rj3q
on-headers is vulnerable to http response header manipulation
Impact
A bug in on-headers versions < 1.1.0 may result in response headers being inadvertently modified when an array is passed to response.writeHead()
Patches
Users should upgrade to 1.1.0
Workarounds
Uses are encouraged to upgrade to 1.1.0, but this issue can be worked around by passing an object to response.writeHead() rather than an array.
- Record
GHSA-76c9-3jph-rj3q- CVSS 3.1
- 3.4 Low
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-241
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-7339
on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions <1.1.0 may result in response headers being inadvertently modified when an array is passed to response.writeHead(). Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to 1.1.0, but this issue can be worked around by passing an object to response.writeHead() rather than an array.
- Record
UBUNTU-CVE-2025-7339- CVSS 3.1
- 3.4 Low
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1773188146 No score
TuxCare security update for diff (3 CVEs)
TuxCare rebuilt diff to address 3 CVEs. Fixed in 1.0.2-tuxcare.1.
- Record
CLSA-2026-1773188146- Updated
- 2026-11-02
OSVCLSA-2026-1774916715 No score
TuxCare security update for on-headers (1 CVE)
TuxCare rebuilt on-headers to address 1 CVE. Fixed in 1.0.2-tuxcare.1.
- Record
CLSA-2026-1774916715- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20919-1 No score
Security update for agama-web-ui
This update for agama-web-ui fixes the following issues
- CVE-2025-7339: on-headers: incorrect array handling may lead to HTTP response header manipulation (bsc#1246678).
- CVE-2026-9277: shell-quote: improper escaping of newlines in object .op values by quote() can lead to shell command injection (bsc#1266256).
- CVE-2026-42041: axios: authentication bypass via validateStatus prototype pollution gadget due to suppression of HTTP error (bsc#1264160).
- CVE-2026-42264: axios: prototype pollution read-side gadgets in HTTP adapter can lead to credential injection and request h (bsc#1264802).
Changes for agama-web-ui:
- Update other dependencies reported by "npm audit".
- Record
openSUSE-SU-2026:20919-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
on-headersnpm |
before 1.1.0 | 1.1.0 |
on-headersTuxCare:npm |
1.0.2-tuxcare.0 up to 1.0.2-tuxcare.1, plus listed versions 1.0.2 |
1.0.2-tuxcare.1 |
node-on-headersDebian:12 |
All versions, plus listed versions 1.0.2-21.0.2-41.1.0-1 |
None known |
node-on-headersDebian:13 |
before 1.0.2-4 | 1.0.2-4 |
node-on-headersDebian:14 |
before 1.0.2-4 | 1.0.2-4 |
node-on-headersUbuntu:16.04:LTS |
All versions, plus listed versions 1.0.0-1 |
None known |
node-on-headersUbuntu:18.04:LTS |
All versions, plus listed versions 1.0.0-1 |
None known |
node-on-headersUbuntu:20.04:LTS |
All versions, plus listed versions 1.0.1-11.0.2-1 |
None known |
node-on-headersUbuntu:22.04:LTS |
All versions, plus listed versions 1.0.2-11.0.2-2 |
None known |
node-on-headersUbuntu:24.04:LTS |
All versions, plus listed versions 1.0.2-2 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
node-on-headersUbuntu:25.10 |
All versions, plus listed versions 1.0.2-21.0.2-4 |
None known |
node-on-headersUbuntu:26.10 |
All versions, plus listed versions 1.0.2-41.1.0-1 |
None known |
node-on-headersUbuntu:26.04:LTS |
All versions, plus listed versions 1.0.2-4 |
None known |
agama-web-uiopenSUSE:Leap 16.0 From an advisory covering 4 CVEs |
before 17+612.d8bf69336-160000.11.1 | 17+612.d8bf69336-160000.11.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-7339 is a low vulnerability (CVSS 3.4) in Jshttp On-headers, published July 17, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. Fixed in on-headers 1.1.0.
References
github.com/jshttp/on-headers/security/advisories/GHSA-76c9-3jph-rj3q
cna.openjsf.org/security-advisories.html
nvd.nist.gov/vuln/detail/CVE-2025-7339
Show 14 moreShow less
security-tracker.debian.org/tracker/CVE-2025-7339
ubuntu.com/security/CVE-2025-7339
cve.org/CVERecord?id=CVE-2025-7339
bugzilla.suse.com/1246678
suse.com/security/cve/CVE-2025-7339