on-headers vulnerable to http response header manipulation
Priority MEDIUM 50CWE-241Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 1 fixed, 26 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00206 10th percentileScored 2026-11-07
Fix Partial on-headers (jshttp): 1.1.0on-headers (npm): 1.1.0Red Hat: 1 advisoryRed Hat: 1 fixed, 26 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jshttp | on-headers | before 1.1.0 | 1.1.0 | Patch available | CNA |
| — | on-headers (npm) | before 1.1.0 | 1.1.0 | Patch available | GHSA-76c9-3jph-rj3q |
- on-headers Vendorjshttp Affected before 1.1.0 Fixed in 1.1.0 Patch available CNA
- on-headers (npm) Vendor— Affected before 1.1.0 Fixed in 1.1.0 Patch available GHSA-76c9-3jph-rj3q
Remediation
- Fix · CNA on-headers (jshttp) Fixed in 1.1.0
- Fix · GHSA-76c9-3jph-rj3q on-headers (npm) Fixed in 1.1.0 Advisory →
Red Hat 1 advisory
- RHSA-2025:21704 Released 2025-11-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.20 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Virtualization | Affected | No fix yet: Fix deferred |
| Network Observability Operator | Affected | No fix yet: Fix deferred |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 2 | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Discovery 1 | Affected | No fix yet: Fix deferred |
| Red Hat Edge Manager preview | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet: Fix deferred |
| Red Hat Process Automation 7 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Profile Analyzer | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet: Fix deferred |
| Red Hat build of OptaPlanner 8 | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4.20 | Fixed | RHSA-2025:21704 |
Not affected: 1 product
- Red Hat Openshift Data Foundation 4.20
Timeline
- 2026-10-02 Threatist record created from CVE-2025-7339
- 2026-10-03 Alias added: GHSA-76c9-3jph-rj3q
- 2026-10-27 Affected versions changed · Red Hat
References
Other 6
- https://github.com/jshttp/on-headers/security/advisories/GHSA-76c9-3jph-rj3q
- https://github.com/jshttp/on-headers/commit/c6e384908c9c6127d18831d16ab0bd96e1231867
- https://cna.openjsf.org/security-advisories.html
- https://github.com/expressjs/morgan/issues/315
- https://github.com/jshttp/on-headers/issues/15
- https://github.com/jshttp/on-headers
More jshttp vulnerabilities
- TI-2024-32039 cookie accepts cookie name, path, and domain with out of bounds characters CVSS 4.0MEDIUM 6.9
Sources
- CVE-2025-7339 · CVE Program
- CVE-2025-7339 · NVD
- FIRST EPSS
- GHSA-76c9-3jph-rj3q · GitHub Advisory Database · CC BY 4.0
- CVE-2025-7339 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences