on-headers is vulnerable to http response header manipulation

🗓️ 17 Jul 2025 21:17:19Reported by GitHub Advisory DatabaseType

On-headers versions below 1.1.0 are vulnerable to HTTP response header manipulation; upgrade recommended.

Reporter	Title	Published	Views	Family All 56
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Security QRadar EDR Software	27 Nov 202512:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in on-headers-1.0.2.tgz	22 Oct 202511:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses werkzeug-3.1.3,fonttools-4.60.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl,lodash.clonedeep-4.5.0.tgz,js-yaml-4.1.0.tgz,mdast-util-towhich is vulnerable to multiple CVEs	30 Jan 202605:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watsonx BI is affected by use of on-headers in node.js middleware used for listening when a response writes headers	17 Sep 202517:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is vulnerable to unintended response header modification	4 Mar 202605:44	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in NodeJS affect IBM Business Automation Workflow Configuration Editor	11 Sep 202511:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java and Node.js	26 Nov 202510:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Log Source Management app for IBM QRadar SIEM includes components with known vulnerabilities	15 Aug 202514:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in Java and Node.js	26 Nov 202510:32	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in node.js affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	29 Dec 202507:26	–	ibm

Vulners

Node

on-headersRange<1.1.0npm

Source	Link
github	www.github.com/jshttp/on-headers/security/advisories/GHSA-76c9-3jph-rj3q
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-7339
github	www.github.com/expressjs/morgan/issues/315
github	www.github.com/jshttp/on-headers/issues/15
github	www.github.com/jshttp/on-headers/commit/c6e384908c9c6127d18831d16ab0bd96e1231867
cna	www.cna.openjsf.org/security-advisories.html
github	www.github.com/advisories/GHSA-76c9-3jph-rj3q

30 Jul 2025 21:06Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.13.4

EPSS0.00036

SSVC

CWE-241