Critical Vulnerability in node-on-headers Package: Response Header Modification Risk
Summary
DEBIAN-CVE-2025-7339: on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions. Affects node-on-headers versions < 1.0.2-4. Fixed in 1.0.2-4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-on-headers package is a middleware for Node.js that allows developers to listen for events when HTTP response headers are written. It is commonly used in web applications to manage response headers effectively. However, certain versions of this package are vulnerable to a bug that can lead to unintended modifications of response headers, particularly when an array is passed to the response.writeHead() method.
Vulnerability Detail
The vulnerability arises from a bug in on-headers versions prior to 1.1.0. When an array is passed to the response.writeHead() function, it may inadvertently modify the response headers, leading to potential security risks and incorrect behavior in applications. This could result in data leakage or manipulation of HTTP responses, which can be exploited by attackers.
How To Fix
Minimum fixed version
1.0.2-4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-on-headersTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid passing an array to the
response.writeHead() method. Instead, they should pass an object. For example, instead of using: response.writeHead(['Header1', 'Value1']), use: response.writeHead({ 'Header1': 'Value1' });
This will prevent the unintended modification of response headers.
Conclusion
In summary, the node-on-headers package has a critical vulnerability that can lead to unintended modifications of HTTP response headers. Users are strongly encouraged to upgrade to version 1.1.0 or later to mitigate this risk. Temporary workarounds are available, but upgrading is the best long-term solution.
See every vulnerability recorded for node-on-headers →
FAQ
node-on-headers is a middleware for Node.js that allows developers to listen for events when HTTP response headers are written.
Versions of node-on-headers prior to 1.1.0 are affected by this vulnerability.
The risks include unintended modification of response headers, which can lead to data leakage or manipulation of HTTP responses.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without requiring access to the code.
If an immediate upgrade is not possible, implement the workaround by passing an object to the response.writeHead() method instead of an array.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-on-headers.
