All the vulnerabilities related to the version 1.7.2 of the package
on-headers is vulnerable to http response header manipulation
A bug in on-headers versions < 1.1.0
may result in response headers being inadvertently modified when an array is passed to response.writeHead()
Users should upgrade to 1.1.0
Uses are encouraged to upgrade to 1.1.0
, but this issue can be worked around by passing an object to response.writeHead()
rather than an array.