CVE-2025-7339: on-headers Package Vulnerable to HTTP Response Header Manipulation
Summary
CVE-2025-7339: on-headers is vulnerable to http response header manipulation. Affects on-headers versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Also tracked for
- node-on-headers · Debian:11
The same CVE-2025-7339 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The on-headers package is a middleware for Node.js that allows developers to manipulate HTTP response headers before they are sent to the client. It is widely used in web applications to manage response headers effectively. However, versions prior to 1.1.0 contain a bug that can lead to unintended modifications of response headers when an array is passed to the response.writeHead() method.
Vulnerability Detail
The vulnerability arises from a bug in on-headers versions less than 1.1.0, where passing an array to the response.writeHead() function can inadvertently modify the HTTP response headers. This can lead to security issues, such as exposing sensitive information or allowing unauthorized access to resources. The technical aspect of this vulnerability is classified under CWE-241, which pertains to improper handling of unexpected data types.
How To Fix
Latest published version: 1.1.0 as of 23 Oct 2026
npm install on-headers@1.1.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to pass an object instead of an array to the
response.writeHead() method. For example: response.writeHead(200, { 'Content-Type': 'text/plain' });
This avoids the bug and prevents unintended header modifications.
Conclusion
The on-headers package is vulnerable to HTTP response header manipulation in versions prior to 1.1.0. Users are strongly encouraged to upgrade to the patched version to secure their applications. If immediate upgrading is not possible, a workaround is available by changing the data type passed to response.writeHead().
See every vulnerability recorded for on-headers →
FAQ
The CVSS score of this vulnerability is 3.4, indicating a low severity level.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The risks include unauthorized access to sensitive information and the possibility of manipulating response headers, which can lead to security breaches.
Yes, you can mitigate the risk by using an object instead of an array when calling response.writeHead().
You can find more information about the on-headers package on its GitHub repository or the npm package page.
