Executive brief
on-headers is a Node.js library that manages HTTP response headers in web applications. A bug in versions before 1.1.0 can cause response headers to be unintentionally modified or corrupted when certain data types are passed to the response.writeHead() function. This could lead to headers being set incorrectly, potentially affecting application functionality or enabling cache poisoning attacks.
Technical details
The vulnerability is a type confusion bug (CWE-241: Improper Handling of Unexpected Data Type) in on-headers versions < 1.1.0. When an array is passed to response.writeHead() instead of the expected object format, the library fails to properly validate or handle the unexpected data type, resulting in response headers being inadvertently modified. The issue is triggered when the library processes headers without type checking. The attack requires application code to pass an array to writeHead(), which may occur through user-controlled input or logic errors. The vulnerability has been patched in version 1.1.0; users can also work around it by explicitly passing objects instead of arrays to response.writeHead().
Affected products
- jshttp on-headers <1.1.0
Timeline
- 2025-07-17: disclosed
- 2025-07-17: patched: Version 1.1.0 released