https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T21:46:41.060832+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-7339 CVE-2025-7339 — on-headers vulnerable to http response header manipulation 2026-10-03T21:46:41.148633+00:00

Affected: jshttp on-headers

on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.

 https://cve.radiocsirt.org/vuln/ghsa-76c9-3jph-rj3q GHSA-76c9-3jph-rj3q — on-headers is vulnerable to http response header manipulation 2026-10-03T21:46:41.148699+00:00

Affected: npm: on-headers

### Impact

A bug in on-headers versions `< 1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`

### Patches

Users should upgrade to `1.1.0`

### Workarounds

Uses are encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.