Vulnerable Library - express-session-1.15.6.tgz
Found in HEAD commit: 77381111af8bc799f10a64e8ee29ecafe895f739
Vulnerabilities
| Vulnerability |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (express-session version) |
Remediation Possible** |
| CVE-2025-7339 |
 Low |
3.4 |
on-headers-1.0.1.tgz |
Transitive |
1.18.2 |
❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2025-7339
Vulnerable Library - on-headers-1.0.1.tgz
Execute a listener when a response is about to write headers
Library home page: https://registry.npmjs.org/on-headers/-/on-headers-1.0.1.tgz
Dependency Hierarchy:
- express-session-1.15.6.tgz (Root Library)
- ❌ on-headers-1.0.1.tgz (Vulnerable Library)
Found in HEAD commit: 77381111af8bc799f10a64e8ee29ecafe895f739
Found in base branch: master
Vulnerability Details
on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions "<1.1.0" may result in response headers being inadvertently modified when an array is passed to "response.writeHead()". Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to "1.1.0", but this issue can be worked around by passing an object to "response.writeHead()" rather than an array.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2025-07-17
URL: CVE-2025-7339
CVSS 3 Score Details (3.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-76c9-3jph-rj3q
Release Date: 2025-07-17
Fix Resolution (on-headers): 1.1.0
Direct dependency fix Resolution (express-session): 1.18.2
Found in HEAD commit: 77381111af8bc799f10a64e8ee29ecafe895f739
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - on-headers-1.0.1.tgz
Execute a listener when a response is about to write headers
Library home page: https://registry.npmjs.org/on-headers/-/on-headers-1.0.1.tgz
Dependency Hierarchy:
Found in HEAD commit: 77381111af8bc799f10a64e8ee29ecafe895f739
Found in base branch: master
Vulnerability Details
on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions "<1.1.0" may result in response headers being inadvertently modified when an array is passed to "response.writeHead()". Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to "1.1.0", but this issue can be worked around by passing an object to "response.writeHead()" rather than an array.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2025-07-17
URL: CVE-2025-7339
CVSS 3 Score Details (3.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-76c9-3jph-rj3q
Release Date: 2025-07-17
Fix Resolution (on-headers): 1.1.0
Direct dependency fix Resolution (express-session): 1.18.2