Description
on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jshttp | on-headers | < 1.1.0 | 1.1.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-on-headers | 1.0.2-4 | — |
| Debian 13 | node-on-headers | 1.0.2-4 | — |
| Debian 12 | node-on-headers | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-on-headers | No fix yet | — |
| Ubuntu 26.04 LTS | node-on-headers | No fix yet | — |
| Ubuntu 25.10 | node-on-headers | No fix yet | — |
| Ubuntu 24.04 LTS | node-on-headers | No fix yet | — |
| Ubuntu 22.04 LTS | node-on-headers | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | node-on-headers | No fix yet | — |
| Ubuntu 18.04 LTS | node-on-headers | No fix yet | — |
| Ubuntu 16.04 LTS | node-on-headers | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | agama-web-ui | 17+612.d8bf69336-160000.11.1 | openSUSE-SU-2026:20919-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-workflows | 3.6.10-r3 | — |
| Wolfi rolling | code-server +1 | 4.102.1-r0 | — |
| Wolfi rolling | json-server | 0.17.4-r2 | — |
| Wolfi rolling | katib-earlystopping +8 | 0.19.0-r31 | — |
| Wolfi rolling | katib-suggestion-goptuna-compat | 0.19.0-r40 | — |
| Wolfi rolling | kubeflow-centraldashboard | 1.10.0-r3 | — |
| Wolfi rolling | serve | 14.2.5-r0 | — |
| Wolfi rolling | sqlpad +1 | 7.5.4-r3 | — |
| Wolfi rolling | thingsboard +4 | 4.1-r5 | — |
| Wolfi rolling | tileserver-gl +1 | 5.3.1-r7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | on-headers | < 1.1.0 | 1.1.0 | GHSA-76c9-3jph-rj3q |
Advisories 5
- openSUSE-SU-2026:20919-1 Security update for agama-web-ui SUSE / openSUSE Security Updates · Jun 10, 2026
- WID-SEC-2025-1929 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 25, 2026
- WID-SEC-2025-2360 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 17, 2025
- NCSC-2025-0330 Kwetsbaarheden verholpen in Oracle Communications producten NCSC-NL (Netherlands) · Oct 23, 2025
- WID-SEC-2025-2345 IBM DataPower Gateway: Schwachstelle ermöglicht Manipulation von Daten und potenziell Denial of Service BSI CERT-Bund (WID) · Oct 20, 2025
References
- https://github.com/jshttp/on-headers/security/advisories/GHSA-76c9-3jph-rj3q
- https://github.com/jshttp/on-headers/commit/c6e384908c9c6127d18831d16ab0bd96e1231867
- https://cna.openjsf.org/security-advisories.html
- https://github.com/expressjs/morgan/issues/315
- https://github.com/jshttp/on-headers/issues/15