Platform
nodejs
Component
on-headers
Fixed in
1.1.0
1.1.0
CVE-2025-7339 is a vulnerability affecting versions of on-headers prior to 1.1.0. This issue allows for potential modification of response headers when an array is passed to the response.writeHead() function. The impact could be subtle but potentially lead to unexpected behavior or security implications. Upgrade to version 1.1.0 to remediate this vulnerability.
The core of this vulnerability lies in the improper handling of data types within the response.writeHead() function. When an array is provided as input, on-headers may incorrectly interpret and modify the response headers being sent to the client. While the immediate impact might not be catastrophic, it could enable attackers to subtly alter the behavior of a web application. For example, an attacker could manipulate headers related to caching, security policies (like Content-Security-Policy), or redirects. This could lead to information disclosure, cross-site scripting (XSS) vulnerabilities, or other unexpected consequences depending on the application's logic. The potential for abuse depends heavily on the application's reliance on these headers.
CVE-2025-7339 was published on 2025-07-17. The CVSS score is LOW (3.4), indicating a relatively low probability of exploitation. There are no known public Proof-of-Concept (POC) exploits available at this time. The vulnerability is not currently listed on CISA Known Exploited Vulnerabilities (KEV) catalog, and EPSS score is pending evaluation. Monitor security advisories and threat intelligence feeds for any updates regarding active exploitation campaigns.
Exploit Status
EPSS
0.01% (1% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-7339 is to upgrade to version 1.1.0 of on-headers. This version includes a fix that correctly handles the input to response.writeHead(). If upgrading is not immediately feasible, a workaround exists: always pass an object instead of an array to the response.writeHead() function. This bypasses the vulnerable code path. Thorough testing is crucial after applying either the upgrade or the workaround to ensure application stability and functionality. After upgrading, confirm the fix by sending requests with array inputs to response.writeHead() and verifying that headers are not modified unexpectedly.
Actualice la versión del paquete `on-headers` a la versión 1.1.0 o superior. Esto solucionará la vulnerabilidad de manipulación de encabezados HTTP. Alternativamente, puede modificar su código para pasar un objeto en lugar de un array a la función `response.writeHead()`.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-7339 is a vulnerability in on-headers versions before 1.1.0 where passing an array to response.writeHead() can inadvertently modify response headers, potentially leading to unexpected application behavior.
You are affected if your project uses on-headers versions earlier than 1.1.0. Check your dependencies to determine if you need to upgrade.
The recommended fix is to upgrade to version 1.1.0 of on-headers. As a temporary workaround, pass an object instead of an array to response.writeHead().
Currently, there are no known public exploits or active campaigns targeting CVE-2025-7339, but continuous monitoring is advised.
Refer to the on-headers project's repository or website for the official advisory and release notes regarding CVE-2025-7339.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.