# Vulnerability Report: Node.js Package on-headers \< 1.1.0 in Node-Red

**URL:** https://discourse.nodered.org/t/vulnerability-report-node-js-package-on-headers-1-1-0-in-node-red/98416
**Category:** General
**Created:** [31 July 2025 12:42 UTC](https://discourse.nodered.org/t/vulnerability-report-node-js-package-on-headers-1-1-0-in-node-red/98416 "2025-07-31T12:42:53Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![GowriAradhya](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gowriaradhya/32/25062_2.png) [@GowriAradhya](https://discourse.nodered.org/u/GowriAradhya)
#### Post date: [31 July 2025 12:42 UTC](https://discourse.nodered.org/t/vulnerability-report-node-js-package-on-headers-1-1-0-in-node-red/98416/1 "2025-07-31T12:42:53Z")

</div>

Hello,

**Component** : Node.js  
**Package** : [`on-headers`](https://www.npmjs.com/package/on-headers)  
**Affected Version** : 1.0.2  
**Used In** : Node-RED `4.0.9`

**Impact** :

- Exposure of Sensitive Information
- Manipulation of Data

**Description** :  
The `on-headers` package (version 1.0.2) used in the Node-red version 4.0.9 is known to have security vulnerabilities that could lead to data exposure or unintended data manipulation

**References:**

> **[NVD - CVE-2025-7339](https://nvd.nist.gov/vuln/detail/CVE-2025-7339)**

---

<div class="post-metadata">

### Author: ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)
#### Post date: [31 July 2025 12:44 UTC](https://discourse.nodered.org/t/vulnerability-report-node-js-package-on-headers-1-1-0-in-node-red/98416/2 "2025-07-31T12:44:32Z")

</div>

Hi,

Node-RED 4.1.0 was released this week that includes updates for this.

For future reference, please follow the project’s security policy for reporting anything security related: [GitHub - node-red/node-red: Low-code programming for event-driven applications](https://github.com/node-red/node-red?tab=security-ov-file#readme) rather than publish to public forum.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)
#### Post date: [29 October 2025 12:45 UTC](https://discourse.nodered.org/t/vulnerability-report-node-js-package-on-headers-1-1-0-in-node-red/98416/3 "2025-10-29T12:45:27Z")

</div>

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.