Vulnerable Library - morgan-1.10.0.tgz
Path to dependency file: /apps/package.json
Path to vulnerable library: /apps/package.json
Found in HEAD commit: 67e0064a6ec67840f7b7e9e817e2d4f93d73b642
Vulnerabilities
| Vulnerability |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (morgan version) |
Remediation Possible** |
| CVE-2025-7339 |
 Low |
3.4 |
on-headers-1.0.2.tgz |
Transitive |
1.10.1 |
❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2025-7339
Vulnerable Library - on-headers-1.0.2.tgz
Execute a listener when a response is about to write headers
Library home page: https://registry.npmjs.org/on-headers/-/on-headers-1.0.2.tgz
Path to dependency file: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
- morgan-1.10.0.tgz (Root Library)
- ❌ on-headers-1.0.2.tgz (Vulnerable Library)
Found in HEAD commit: 67e0064a6ec67840f7b7e9e817e2d4f93d73b642
Found in base branch: develop
Vulnerability Details
on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions "<1.1.0" may result in response headers being inadvertently modified when an array is passed to "response.writeHead()". Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to "1.1.0", but this issue can be worked around by passing an object to "response.writeHead()" rather than an array.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2025-07-17
URL: CVE-2025-7339
CVSS 3 Score Details (3.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-76c9-3jph-rj3q
Release Date: 2025-07-17
Fix Resolution (on-headers): 1.1.0
Direct dependency fix Resolution (morgan): 1.10.1
Step up your Open Source Security Game with Mend here
Path to dependency file: /apps/package.json
Path to vulnerable library: /apps/package.json
Found in HEAD commit: 67e0064a6ec67840f7b7e9e817e2d4f93d73b642
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - on-headers-1.0.2.tgz
Execute a listener when a response is about to write headers
Library home page: https://registry.npmjs.org/on-headers/-/on-headers-1.0.2.tgz
Path to dependency file: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
Found in HEAD commit: 67e0064a6ec67840f7b7e9e817e2d4f93d73b642
Found in base branch: develop
Vulnerability Details
on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions "<1.1.0" may result in response headers being inadvertently modified when an array is passed to "response.writeHead()". Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to "1.1.0", but this issue can be worked around by passing an object to "response.writeHead()" rather than an array.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2025-07-17
URL: CVE-2025-7339
CVSS 3 Score Details (3.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-76c9-3jph-rj3q
Release Date: 2025-07-17
Fix Resolution (on-headers): 1.1.0
Direct dependency fix Resolution (morgan): 1.10.1
Step up your Open Source Security Game with Mend here