CVE-2025-7339
1 advisory.
npm/on-headers CVE-2025-7339: low 3.4, EPSS 0.21%
on-headers is vulnerable to http response header manipulation
Action: Upgrade on-headers to 1.1.0 or later.
npm i on-headers@1.1.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.1.0 | - |
Fixed versions
| 1.1.0 |
Sources
- osv: GHSA-76c9-3jph-rj3q
- https://github.com/jshttp/on-headers/security/advisories/GHSA-76c9-3jph-rj3q
- https://nvd.nist.gov/vuln/detail/CVE-2025-7339
- https://github.com/expressjs/morgan/issues/315
- https://github.com/jshttp/on-headers/issues/15
- https://github.com/jshttp/on-headers/commit/c6e384908c9c6127d18831d16ab0bd96e1231867
- https://cna.openjsf.org/security-advisories.html
- https://github.com/jshttp/on-headers
CVE-2025-7339 · published · modified · JSON