Listen to this Post
The CVE-2025-12345 vulnerability in the `on-headers` module (versions < 1.1.0) arises due to improper handling of HTTP response headers when an array is passed to response.writeHead(). This flaw allows attackers to manipulate headers by injecting or modifying them, leading to potential security risks such as cache poisoning, cross-site scripting (XSS), or unauthorized data exposure. The issue occurs because the module fails to properly validate and sanitize header arrays before processing, allowing malformed input to alter the intended header structure.
DailyCVE Form:
Platform: Node.js
Version: < 1.1.0
Vulnerability: Header Manipulation
Severity: Medium
Date: Jul 17, 2025
Prediction: Patch expected by Jul 24, 2025
What Undercode Say:
npm audit fix --force git clone https://github.com/jshttp/on-headers curl -X GET http://vuln-site.com -H "X-Malicious: injected"
How Exploit:
- Craft malicious HTTP headers.
- Send manipulated array via
writeHead(). - Bypass security checks.
Protection from this CVE:
- Upgrade to
[email protected]. - Use objects instead of arrays.
- Sanitize headers manually.
Impact:
- Cache poisoning.
- XSS attacks.
- Data leakage.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
