Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-7339

13
FAUCET Score

CVE-2025-7339 describes a bug in the node.js on-headers middleware, specifically in versions prior to 1.1.0. This vulnerability allows for inadvertent modification of response headers if an array is passed to response.writeHead(). The CVSS score is 3.4 (LOW), indicating a local attack vector with low attack complexity and potential for limited confidentiality and integrity impact. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
JshttpOn-Headers
>= 0, < 1.1.0CNA affecteddefault unaffected

CVSS Data

CVSS version used by this source: 3.1

3.4LOW

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
Exploitability Score
0.8
Impact Score
2.5
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.17%
Probability of exploitation in next 30 days
EPSS Percentile
7.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0017 is in the 37th percentile among its peer group of 158 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (119)

npmpatch availablevia ghsa
Product: on-headersFixed in: 1.1.0
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/odf-cli-rhel9:sha256:3fce5a9df8c3bc0de1880a6c6e306e6515df91a3e3a730afcbf1399e98771c86
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/cephcsi-rhel9:sha256:e5f93f28233a86972cde565fe3564b47a739ff0d99f0c76d9113c35665dc8075
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/odf-cloudnative-pg-rhel9-operator:sha256:7224dca7e4baad69af171bd79a49fd79a8a8cf686aec25d6d33a9266be945362
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/odf-console-rhel9:sha256:8439ea9b94e6ebe0038c0fa74914c26839532c716c5e25e5f525318be10ca67e
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/odf-cosi-sidecar-rhel9:sha256:694354fb3e2505c0b47c296d601b95f3a020df9a1e3f7e4b8ccf759b3073f57d
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/odf-csi-addons-rhel9-operator:sha256:b7e21acb1b51d50e88d92907a82632ba4955aa0a7e8749537cdad88b92513c8c
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/odf-csi-addons-sidecar-rhel9:sha256:e09d93454d49936467874177434f591df6918a828aa09c22e443d07adc716649
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/odf-external-snapshotter-rhel9-operator:sha256:48c5ff6cef7d6df2220c851dee07213c98bcf8019a03c265a9de040e87401f49
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/odf-external-snapshotter-sidecar-rhel9:sha256:a07d753741e8f635c03ff0fa83ae28a0f8b444678c92e109784bea549a840624
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/odf-multicluster-console-rhel9:sha256:8899629b9124b774fc6cc1e4aa8bd655f61989114f381d0b542b428e7d6000b8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/ocs-rhel9-operator:sha256:28fef0042ac3b41929f2f8fe29786eaf7bc38a9ffb6ef4d5c7c3fba275312ce1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/odf-must-gather-rhel9:sha256:56d41a2a9dbb590dbf1690949e16602b38c1a97fd8698272a0f0d5f5f82389c5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/odf-rhel9-operator:sha256:fb8c5faf2e866c02d0cb11e71430d95fe3ceab5f15ff2a82be2ee86d0a57de3c
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/odr-rhel9-operator:sha256:c3b69f08c0ca813e311eb84d562dcefa9a6651e605b250c46e6bb70ac93f698a
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/rook-ceph-rhel9-operator:sha256:28853c9db8d0a54d42c7f4fcaa591a80dd3e5273d8e463d3496fbe334f9f9721
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/cephcsi-rhel9-operator:sha256:7264546472b9841c67d768bfc24a4120b4d9216de91779a90bf918636d2cb558
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/mcg-core-rhel9:sha256:8c82a478ebc0918907971653269363058257118c6734c6589bb7e13d00c9388f
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/mcg-rhel9-operator:sha256:b88f11532b8d0c1f673e2c7e454cf7637e9830cf25bdfc61b71fb8b98947c73f
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/ocs-client-console-rhel9:sha256:d9fb83925ac1a019c400b603171c43b23f726dabaf933420a32dfc9d28571d24
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/ocs-client-rhel9-operator:sha256:c50de6e5c0a3705afb02e9301073992484bdeb989f9e529920848c609713cefc
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/ocs-metrics-exporter-rhel9:sha256:f8640c08269f281d041f5ffe39db8c4401e361a861ee205740f36969eb8b8aaf
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Openshift Data Foundation 4.2Fixed in: odf4/odf-multicluster-rhel9-operator:sha256:55f1c53dab3fd98faef3888b81536ed2aab60de198938fdc55afd0eae1d678aa
View patch
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-pilot-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-proxyv2-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-rhel9-operator
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-sail-operator-bundle
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/kiali-operator-bundle
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/kiali-ossmc-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/kiali-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/kiali-rhel9-operator
redhatvendor investigatingvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-24/lightspeed-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: ansible-automation-platform-25/lightspeed-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: automation-controller
redhatvendor investigatingvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: automation-eda-controller
redhatvendor investigatingvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: automation-gateway
redhatvendor investigatingvia redhat_api
Product: Red Hat build of Apache Camel - HawtIO 4Fixed in: io.hawt-project
redhatvendor investigatingvia redhat_api
Product: Red Hat build of Apicurio Registry 2Fixed in: io.apicurio-apicurio-registry
redhatvendor investigatingvia redhat_api
Product: Red Hat build of OptaPlanner 8Fixed in: org.optaweb.vehiclerouting-optaweb-vehicle-routing
redhatvendor investigatingvia redhat_api
Product: Red Hat Data Grid 8Fixed in: org.infinispan-infinispan-console
redhatvendor investigatingvia redhat_api
Product: Red Hat Developer HubFixed in: rhdh/rhdh-hub-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Developer HubFixed in: rhdh/rhdh-rhel9-operator
redhatvendor investigatingvia redhat_api
Product: Red Hat Discovery 1Fixed in: discovery/discovery-ui-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Edge Manager previewFixed in: rhem/flightctl-api-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Edge Manager previewFixed in: rhem/flightctl-cli-artifacts-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Edge Manager previewFixed in: rhem/flightctl-periodic-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Edge Manager previewFixed in: rhem/flightctl-ui-ocp-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Edge Manager previewFixed in: rhem/flightctl-ui-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Edge Manager previewFixed in: rhem/flightctl-worker-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: pcs
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: pcs
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: io.apicurio-apicurito
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: io.hawt-hawtio-online
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: io.syndesis-syndesis-parent
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-codeflare-operator-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-dashboard-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-dashboard-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-data-science-pipelines-argo-argoexec-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-data-science-pipelines-operator-controller-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-kf-notebook-controller-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-kuberay-operator-controller-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-kueue-controller-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-mlmd-grpc-server-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-ml-pipelines-api-server-v2-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-ml-pipelines-driver-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-ml-pipelines-launcher-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-ml-pipelines-persistenceagent-v2-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-ml-pipelines-runtime-generic-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-mm-rest-proxy-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-model-controller-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-modelmesh-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-modelmesh-runtime-adapter-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-modelmesh-serving-controller-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-model-registry-operator-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-model-registry-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-notebook-controller-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-rhel8-operator
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-training-operator-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-trustyai-service-operator-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-trustyai-service-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-trustyai-service-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhods/odh-dashboard-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhods/odh-rhel8-operator
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift distributed tracing 3Fixed in: rhosdt/tempo-jaeger-query-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/argocd-extensions-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/argocd-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/argo-rollouts-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/console-plugin-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/dex-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/gitops-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/gitops-rhel8-operator
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/must-gather-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat Process Automation 7Fixed in: org.uberfire-uberfire-parent
redhatvendor investigatingvia redhat_api
Product: Red Hat Quay 3Fixed in: quay/quay-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat Trusted Profile AnalyzerFixed in: rhtpa/rhtpa-trustification-service-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9
redhatvendor investigatingvia redhat_api
Product: Cryostat 4Fixed in: cryostat/cryostat-openshift-console-plugin-rhel9
redhatvendor investigatingvia redhat_api
Product: Cryostat 4Fixed in: io.cryostat-cryostat
redhatvendor investigatingvia redhat_api
Product: Migration Toolkit for ContainersFixed in: rhmtc/openshift-migration-ui-rhel8
redhatvendor investigatingvia redhat_api
Product: Migration Toolkit for VirtualizationFixed in: migration-toolkit-virtualization/mtv-console-plugin-rhel9
redhatvendor investigatingvia redhat_api
Product: Migration Toolkit for VirtualizationFixed in: mtv-candidate/mtv-console-plugin-rhel9
redhatvendor investigatingvia redhat_api
Product: Network Observability OperatorFixed in: network-observability/network-observability-console-plugin-compat-rhel9
redhatvendor investigatingvia redhat_api
Product: Network Observability OperatorFixed in: network-observability/network-observability-console-plugin-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift LightspeedFixed in: openshift-lightspeed/lightspeed-console-plugin-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift PipelinesFixed in: openshift-pipelines/pipelines-console-plugin-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift PipelinesFixed in: openshift-pipelines/pipelines-console-plugin-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift PipelinesFixed in: openshift-pipelines/pipelines-hub-api-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift PipelinesFixed in: openshift-pipelines/pipelines-hub-api-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift PipelinesFixed in: openshift-pipelines/pipelines-hub-db-migration-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift PipelinesFixed in: openshift-pipelines/pipelines-hub-db-migration-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift PipelinesFixed in: openshift-pipelines/pipelines-hub-ui-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift PipelinesFixed in: openshift-pipelines/pipelines-hub-ui-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift ServerlessFixed in: openshift-serverless-1/kn-backstage-plugins-eventmesh-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 2Fixed in: openshift-service-mesh/kiali-ossmc-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 2Fixed in: openshift-service-mesh/kiali-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-cni-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-must-gather-rhel9

Vendor Advisories (3)

npmGHSA-76c9-3jph-rj3qlow

on-headers is vulnerable to http response header manipulation

Jul 17, 2025
redhatCVE-2025-7339Low

on-headers: on-headers vulnerable to http response header manipulation

Jul 17, 2025
microsoft2025-Jul/CVE-2025-7339Low

on-headers vulnerable to http response header manipulation

Jul 8, 2025

References

cna.openjsf.org / security-advisories.html
github.com / expressjs/morgan/issues/315
github.com / jshttp/on-headers/commit/c6e384908c9c6127d18831d16ab0bd96e1231867
github.com / jshttp/on-headers/issues/15
github.com / jshttp/on-headers/security/advisories/GHSA-76c9-3jph-rj3q