jshttp on-headers up to 1.0.x Response Header response.writeHead unexpected data type

Summaryinfo

A vulnerability marked as problematic has been reported in jshttp on-headers up to 1.0.x. This affects the function response.writeHead of the component Response Header Handler. The manipulation leads to improper handling of unexpected data type. This vulnerability is referenced as CVE-2025-7339. The attack can only be performed from a local environment. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in jshttp on-headers up to 1.0.x. This issue affects the function response.writeHead of the component Response Header Handler. The manipulation with an unknown input leads to a improper handling of unexpected data type vulnerability. Using CWE to declare the problem leads to CWE-241. The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2025-7339 since 07/07/2025. The exploitation is known to be easy. Attacking locally is a requirement. The exploitation requires an enhanced level of successful authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.1.0 eliminates this vulnerability. Applying the patch c6e384908c9c6127d18831d16ab0bd96e1231867 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at EUVD (EUVD-2025-21784) and CERT Bund (WID-SEC-2025-1929). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• IBM App Connect Enterprise

Productinfo

Vendor

• jshttp

Name

• on-headers

Version

• 1.0

License

• open-source

Website

• Product: https://github.com/jshttp/on-headers/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion