{"id":"CVE-2025-7339","aliases":["CLSA-2026-1773188146","CLSA-2026-1774916715","DEBIAN-CVE-2025-7339","EUVD-2025-21784","GHSA-76c9-3jph-rj3q","UBUNTU-CVE-2025-7339","openSUSE-SU-2026:20919-1"],"status":"published","title":"on-headers vulnerable to http response header manipulation","description":"on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `\u003c1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.","severity":{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00206,"percentile":0.10689,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-241"],"published":"2025-07-17T15:47:39Z","modified":"2026-10-28T02:30:23Z","fixes":[{"ecosystem":"npm","package":"on-headers","fixed_in":["1.1.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"on-headers","fixed_in":["1.0.2-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-on-headers","fixed_in":["1.0.2-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-on-headers","fixed_in":["1.0.2-4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"on-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"on-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.2-tuxcare.0"},{"fixed":"1.0.2-tuxcare.1"}]}],"versions":["1.0.2"]},{"source":"osv","ecosystem":"Debian:12","package":"node-on-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2-2","1.0.2-4","1.1.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-on-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-on-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-4"}]}]},{"source":"osv","ecosystem":"npm","package":"on-headers","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.0"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-on-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-on-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-on-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-1","1.0.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-on-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2-1","1.0.2-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-on-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-on-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2-2","1.0.2-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-on-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2-4","1.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-on-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2-4"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"agama-web-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17+612.d8bf69336-160000.11.1"}]}],"bundled":4}],"products":[{"vendor":"jshttp","product":"on-headers"}],"references":[{"url":"https://github.com/jshttp/on-headers/security/advisories/GHSA-76c9-3jph-rj3q","tags":["advisory","web","report"]},{"url":"https://github.com/jshttp/on-headers/commit/c6e384908c9c6127d18831d16ab0bd96e1231867","tags":["fix","web"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["advisory","web","report"]},{"url":"https://github.com/expressjs/morgan/issues/315","tags":["report","web"]},{"url":"https://github.com/jshttp/on-headers/issues/15","tags":["report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7339","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-76c9-3jph-rj3q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7339.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-7339","tags":["advisory"]},{"url":"https://github.com/jshttp/on-headers","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-7339","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-7339","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1246678","tags":["report"]},{"url":"https://bugzilla.suse.com/1264160","tags":["report"]},{"url":"https://bugzilla.suse.com/1264802","tags":["report"]},{"url":"https://bugzilla.suse.com/1266256","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9277","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-7339","title":"on-headers vulnerable to http response header manipulation","description":"on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `\u003c1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.","status":"published","published":"2025-07-17T15:47:39.68Z","modified":"2025-07-17T20:24:47.447Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-241"],"updated_at":"2026-11-02T14:32:51.544289Z"}],"euvd":[{"id":"EUVD-2025-21784","description":"on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `\u003c1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.","status":"published","published":"2025-07-17T15:47:39Z","modified":"2025-07-17T20:24:47Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T20:32:07.018976Z"}],"ghsa":[{"id":"GHSA-76c9-3jph-rj3q","title":"on-headers is vulnerable to http response header manipulation","description":"### Impact\n\nA bug in on-headers versions `\u003c 1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`\n\n### Patches\n\nUsers should upgrade to `1.1.0`\n\n### Workarounds\n\nUses are encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.","status":"published","published":"2025-07-17T21:17:19Z","modified":"2025-07-30T21:06:13Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-241"],"updated_at":"2026-11-02T14:38:51.864708Z"}],"nvd":[{"id":"CVE-2025-7339","description":"on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `\u003c1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.","status":"published","published":"2025-07-17T16:15:35.403Z","modified":"2026-06-17T10:04:45.18Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-241"],"updated_at":"2026-11-02T14:11:18.782156Z"}],"osv":[{"id":"CVE-2025-7339","title":"on-headers vulnerable to http response header manipulation","description":"on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `\u003c1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.","status":"published","published":"2025-07-17T15:47:39.68Z","modified":"2026-10-28T02:30:23.848078101Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-241"],"updated_at":"2026-11-02T15:44:53.185592Z"},{"id":"DEBIAN-CVE-2025-7339","description":"on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `\u003c1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.","status":"published","published":"2025-07-17T16:15:35.403Z","modified":"2026-09-01T20:05:59.417262482Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:48.440897Z"},{"id":"GHSA-76c9-3jph-rj3q","title":"on-headers is vulnerable to http response header manipulation","description":"### Impact\n\nA bug in on-headers versions `\u003c 1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`\n\n### Patches\n\nUsers should upgrade to `1.1.0`\n\n### Workarounds\n\nUses are encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.","status":"published","published":"2025-07-17T21:17:19Z","modified":"2026-09-10T03:50:25.957948294Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-241"],"updated_at":"2026-11-02T15:46:40.657155Z"},{"id":"UBUNTU-CVE-2025-7339","description":"on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `\u003c1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.","status":"published","published":"2025-07-17T16:15:00Z","modified":"2026-10-17T12:57:34.477069904Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:55:55.926217Z"},{"id":"CLSA-2026-1773188146","title":"TuxCare security update for diff (3 CVEs)","description":"TuxCare rebuilt diff to address 3 CVEs. Fixed in 1.0.2-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:12Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774916715","title":"TuxCare security update for on-headers (1 CVE)","description":"TuxCare rebuilt on-headers to address 1 CVE. Fixed in 1.0.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:17Z","modified":"2026-10-15T09:47:48.834374617Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"openSUSE-SU-2026:20919-1","title":"Security update for agama-web-ui","description":"This update for agama-web-ui fixes the following issues\n\n- CVE-2025-7339: on-headers: incorrect array handling may lead to HTTP response header manipulation (bsc#1246678).\n- CVE-2026-9277: shell-quote: improper escaping of newlines in object .op values by quote() can lead to shell command\n  injection (bsc#1266256).\n- CVE-2026-42041: axios: authentication bypass via validateStatus prototype pollution gadget due to suppression of HTTP\n  error (bsc#1264160).\n- CVE-2026-42264: axios: prototype pollution read-side gadgets in HTTP adapter can lead to credential injection and\n  request h (bsc#1264802).\n\nChanges for agama-web-ui:\n\n- Update other dependencies reported by \"npm audit\".\n","status":"published","published":"2026-06-08T10:21:35Z","modified":"2026-06-10T18:24:17.693678831Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}