Skip to content
Fencer Intel
low 3.4

CVE-2025-7339 json

on-headers vulnerable to http response header manipulation

published last yr. modified last mo. also GHSA-76c9-3jph-rj3q , EUVD-2025-21784

cvss
3.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits
0
none known

Summary

on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.

Patch / fix

  • npm on-headers 1.1.0
  • jshttp on-headers 1.1.0
  • agama-web-ui openSUSE Leap 16.0 17+612.d8bf69336-160000.11.1

opensuse advisories openSUSE-SU-2026:20919-1

Is CVE-2025-7339 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-7339 updated cvss 3.4

on-headers: on-headers vulnerable to http response header manipulation

  • Red Hat Cryostat 4 io.cryostat-cryostat, cryostat/cryostat-openshift-console-plugin-rhel9 Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-ui-rhel8 Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-console-plugin-rhel9, migration-toolkit-virtualization/mtv-console-plugin-rhel9 Red Hat Network Observability Operator network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-console-plugin-compat-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-hub-api-rhel8, openshift-pipelines/pipelines-hub-api-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9, +2 more
    +20 more products
    Red Hat OpenShift Serverless openshift-serverless-1/kn-backstage-plugins-eventmesh-rhel8 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8, openshift-service-mesh/kiali-ossmc-rhel8 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9, openshift-service-mesh/istio-cni-rhel9, openshift-service-mesh/istio-pilot-rhel9, openshift-service-mesh/kiali-ossmc-rhel9, openshift-service-mesh/istio-proxyv2-rhel9, openshift-service-mesh/istio-rhel9-operator, +5 more Red Hat Ansible Automation Platform 2 automation-gateway, automation-controller, automation-eda-controller, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/lightspeed-rhel8 Red Hat build of Apache Camel - HawtIO 4 io.hawt-project Red Hat build of Apicurio Registry 2 io.apicurio-apicurio-registry Red Hat build of OptaPlanner 8 org.optaweb.vehiclerouting-optaweb-vehicle-routing Red Hat Data Grid 8 org.infinispan-infinispan-console Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9, rhdh/rhdh-rhel9-operator Red Hat Discovery 1 discovery/discovery-ui-rhel9 Red Hat Edge Manager preview rhem/flightctl-ui-rhel9, rhem/flightctl-api-rhel9, rhem/flightctl-ui-ocp-rhel9, rhem/flightctl-worker-rhel9, rhem/flightctl-periodic-rhel9, rhem/flightctl-cli-artifacts-rhel9 Red Hat Enterprise Linux 8 pcs, pcs-snmp Red Hat Enterprise Linux 9 pcs, pcs-snmp Red Hat Fuse 7 io.apicurio-apicurito, io.hawt-hawtio-online, io.syndesis-syndesis-parent Red Hat OpenShift AI (RHOAI) rhoai/odh-rhel8-operator, rhods/odh-rhel8-operator, rhoai/odh-dashboard-rhel8, rhoai/odh-dashboard-rhel9, rhoai/odh-modelmesh-rhel8, rhods/odh-dashboard-rhel8, +25 more Red Hat OpenShift distributed tracing 3 rhosdt/tempo-jaeger-query-rhel8 Red Hat OpenShift GitOps openshift-gitops-1/dex-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/gitops-rhel8, openshift-gitops-1/must-gather-rhel8, openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/console-plugin-rhel8, +2 more Red Hat Process Automation 7 org.uberfire-uberfire-parent Red Hat Quay 3 quay/quay-rhel8 Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9
    affected: workaround, no fix available “Users may work around this issue by passing an object rather than an array to the `response.writeHead()` function.”
  • Red Hat Openshift Data Foundation 4.20 odf4 v4.20-1761728558, odf4 v4.20-1761728716, odf4 v4.20-1761728784, odf4 v4.20-1761728797, odf4 v4.20-1761728814, odf4 v4.20-1761728854, +16 more
    fixed: vendor fix “Users may work around this issue by passing an object rather than an array to the `response.writeHead()` function.” RHSA-2025:21704
  • Red Hat Openshift Data Foundation 4.20 odf4 v4.20-1762875806, odf4 v4.20-1762875810, odf4 v4.20-1762875812, odf4 v4.20-1762875816, odf4 v4.20-1762875818, odf4 v4.20-1762875825, +6 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 3.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
GitHub 3.1 3.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm on-headers
<1.1.0
1.1.0

Affected products

  • jshttp on-headers

Classification

Weakness
  • CWE-241 Improper Handling of Unexpected Data Type

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.