Critical Vulnerability in node-on-headers: Header Modification Risk
Summary
CVE-2025-7339: on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions. Affects node-on-headers versions < c6e384908c9c6127d18831d16ab0bd96e1231867. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-on-headers is a middleware for Node.js that allows developers to listen for when a response writes headers. It is commonly used in web applications to manage HTTP responses effectively. The package is designed to enhance the functionality of HTTP headers, but it has a vulnerability that can lead to unintended modifications of response headers when certain data types are passed to the response methods.
Vulnerability Detail
The vulnerability, identified as CVE-2025-7339, affects versions of node-on-headers prior to 1.1.0. The issue arises when an array is passed to the response.writeHead() method, which can inadvertently modify the response headers. This can lead to unexpected behavior in web applications, potentially exposing sensitive information or causing incorrect responses to be sent to clients.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid passing arrays to the
response.writeHead() method. Instead, they should pass an object. For example: response.writeHead(200, { 'Content-Type': 'application/json' });
Conclusion
The vulnerability CVE-2025-7339 in the node-on-headers package poses a significant risk by allowing unintended modifications of HTTP response headers. Users are strongly encouraged to upgrade to version 1.1.0 to mitigate this risk. Temporary workarounds are available, but they do not replace the need for a proper fix.
See every vulnerability recorded for node-on-headers →
FAQ
CVE-2025-7339 is a vulnerability in the node-on-headers package that can lead to unintended modifications of HTTP response headers.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Not fixing this vulnerability can lead to unexpected behavior in web applications, including the potential exposure of sensitive information.
Yes, a patch is available in version 1.1.0 of the node-on-headers package.
If an immediate upgrade is not possible, you can implement a workaround by passing an object instead of an array to the response.writeHead() method.
Related vulnerabilities
Recent vulnerabilities recorded for node-on-headers.
