{"action":"Upgrade on-headers to 1.1.0 or later.","affected":[{"fixed":"1.1.0","introduced":"0"}],"component":"on-headers","cve_ids":["CVE-2025-7339"],"ecosystem":"npm","epss":0.00206,"exploited":false,"fixed_versions":["1.1.0"],"ghsa_id":"GHSA-76c9-3jph-rj3q","id":"tcs_01M5KF8YY0669DTF8Y7WCXR88V","modified_at":"2026-09-10T03:50:25.957948294Z","published_at":"2025-07-17T21:17:19Z","references":["https://osv.dev/vulnerability/GHSA-76c9-3jph-rj3q","https://github.com/jshttp/on-headers/security/advisories/GHSA-76c9-3jph-rj3q","https://nvd.nist.gov/vuln/detail/CVE-2025-7339","https://github.com/expressjs/morgan/issues/315","https://github.com/jshttp/on-headers/issues/15","https://github.com/jshttp/on-headers/commit/c6e384908c9c6127d18831d16ab0bd96e1231867","https://cna.openjsf.org/security-advisories.html","https://github.com/jshttp/on-headers"],"severity":{"label":"low","score":3.4},"sources":[{"source":"osv","source_id":"GHSA-76c9-3jph-rj3q","url":"https://osv.dev/vulnerability/GHSA-76c9-3jph-rj3q"}],"summary":"on-headers is vulnerable to http response header manipulation"}