PT-2025-29924 · Unknown+1 · On-Headers+1

Spodjasek + 1 · Published 2025-07-17 · Updated 2025-07-21 · CVE-2025-7339

Positive Technologies (AI Summary)

CVSS v3.1

3.4

Low

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions on-headers versions prior to 1.1.0

Description on-headers is a Node.js middleware used for listening to response headers. A flaw in versions prior to 1.1.0 may allow unintended modification of response headers when an array is passed to response.writeHead().

Recommendations Upgrade to version 1.1.0. As a workaround, pass an object to response.writeHead() instead of an array.

Fix

Weakness Enumeration

CWE-241

Related Identifiers

CVE-2025-7339

GHSA-76C9-3JPH-RJ3Q

Affected Products

Debian

On-Headers

References · 20

• https://cve.org/CVERecord?id=CVE-2025-7339 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-7339 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-7339 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-7339 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7339 · Security Note
• https://osv.dev/vulnerability/GHSA-76c9-3jph-rj3q · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-7339 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-7339 · Vendor Advisory
• https://github.com/expressjs/morgan/issues/315 · Note
• https://github.com/freelensapp/freelens/releases/tag/v1.5.2 · Reddit Post
• https://github.com/jshttp/on-headers/commit/c6e384908c9c6127d18831d16ab0bd96e1231867 · Note
• https://github.com/jshttp/on-headers/issues/15 · Note
• https://github.com/jshttp/on-headers/security/advisories/GHSA-76c9-3jph-rj3q · Note
• https://github.com/jshttp/on-headers · Note
• https://twitter.com/VulmonFeeds/status/1945901716383117493 · Twitter Post