StackRadar

CVE-2025-7339

Low

Advisory

Published 17 Jul 2025In the index since 5 Sept 2026
Severity
Low
worst across findings
CVSS
3.4
base score, highest
EPSS
0.002
7th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
213
of 17,781 indexed, latest versions
Container images
206
deployed by those charts
Fix available
1 of 1
affected package

on-headers is vulnerable to http response header manipulation

Carried by container images the latest versions of 213 of 17,781 indexed charts deploy, on 206 images.

Affected packageAffected versionsFixed inImages
on-headersnpm1.0.1, 1.0.21.1.0206
OSV records
GHSA-76c9-3jph-rj3q

Charts affected

213 by stars
ChartLatestAffected imagesRadar Score
fdi-dotstatsuite-dlmstatcan0.3.11 of 1See more

fdi-dotstatsuite-dlm statcan 0.3.1

1 of the 1 container images this version deploys carry CVE-2025-7339.

Container imageDigestPackageFixed in
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
on-headers@1.0.2
1.1.0

Open the chart page →

3,881
trudesktechpreta1.0.01 of 3See more

trudesk techpreta 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-7339.

Container imageDigestPackageFixed in
polonel/trudesk:1.2.60cf6513f6fe3
on-headers@1.0.2
1.1.0

Open the chart page →

4,017
chatqnatest-opea1.0.01 of 11See more

chatqna test-opea 1.0.0

1 of the 11 container images this version deploys carry CVE-2025-7339.

Container imageDigestPackageFixed in
redis/redis-stack:7.2.0-v91c5f43fddcdd
on-headers@1.0.2
1.1.0

Open the chart page →

39,090
redis-vector-dbtest-opea1.0.01 of 1See more

redis-vector-db test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-7339.

Container imageDigestPackageFixed in
redis/redis-stack:7.2.0-v91c5f43fddcdd
on-headers@1.0.2
1.1.0

Open the chart page →

5,604
vehicle-dashboardtest-vehi-dash0.1.01 of 7See more

vehicle-dashboard test-vehi-dash 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-7339.

Container imageDigestPackageFixed in
samajh/alprfrontend:latest05ef4fddbb75
on-headers@1.0.2
1.1.0

Open the chart page →

20,270
node-redth0ths-helm-charts0.2.11 of 2See more

node-red th0ths-helm-charts 0.2.1

1 of the 2 container images this version deploys carry CVE-2025-7339.

Container imageDigestPackageFixed in
th0th/node-red:4.0.3-debiand06fa39f7406
on-headers@1.0.2
1.1.0

Open the chart page →

2,408
csmmth-chartsVerified publisher0.1.01 of 3See more

csmm th-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2025-7339.

Container imageDigestPackageFixed in
catalysm/csmm:latestf003b35f54d9
on-headers@1.0.2
1.1.0

Open the chart page →

3,576
thingsboardthingsboardVerified publisher0.1.31 of 12See more

thingsboard thingsboard 0.1.3

1 of the 12 container images this version deploys carry CVE-2025-7339.

Container imageDigestPackageFixed in
thingsboard/tb-web-ui:3.4.157f98ed53b3d
on-headers@1.0.2
1.1.0

Open the chart page →

25,394
node-redthl-chartsVerified publisher0.1.01 of 1See more

node-red thl-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-7339.

Container imageDigestPackageFixed in
nodered/node-red:3.0.2-18e2632a7a35dd
on-headers@1.0.2
1.1.0

Open the chart page →

2,806
unleash-proxyunleash0.8.121 of 1See more

unleash-proxy unleash 0.8.12

1 of the 1 container images this version deploys carry CVE-2025-7339.

Container imageDigestPackageFixed in
unleashorg/unleash-proxy:v1.4.82538f89e2685
on-headers@1.0.2
1.1.0

Open the chart page →

929
genievhdirkVerified publisher0.1.31 of 1See more

genie vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2025-7339.

Container imageDigestPackageFixed in
stanfordoval/almond-server:latest1a63cdccedaf
on-headers@1.0.2
1.1.0

Open the chart page →

3,129
hedgedocvista0.1.11 of 1See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-7339.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
on-headers@1.0.2
1.1.0

Open the chart page →

3,118
workadventureworkadventure1.1.01 of 9See more

workadventure workadventure 1.1.0

1 of the 9 container images this version deploys carry CVE-2025-7339.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-uploader:v1.17.73ccd467543b3
on-headers@1.0.2
1.1.0

Open the chart page →

16,083

Container images carrying it

206 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
matrixdotorg/matrix-appservice-gitter:latest0d37b4d42b47
on-headers@1.0.2
1.1.0
1
misskey/misskey:12.110.1e08b7c478093
on-headers@1.0.2
1.1.0
1
mitchxxx/amazon:214e72480ec63a
on-headers@1.0.2
1.1.0
1
moonrailgun/tianji:1.11.2b528c8f8fcc4
on-headers@1.0.2
1.1.0
1
n8nio/n8n:1.86.08b39ed5a2de9
on-headers@1.0.2
1.1.0
1
n8nio/n8n:0.212.0a9195bc499a3
on-headers@1.0.2
1.1.0
1
n8nio/n8n:1.33.1dd171d45102a
on-headers@1.0.2
1.1.0
1
netrisai/controller-web-service-backend:4.6.0-0086e865080e86c
on-headers@1.0.2
1.1.0
1
nightscout/cgm-remote-monitor:14.2.500c3b4833f1b
on-headers@1.0.2
1.1.0
1
nightscout/cgm-remote-monitor:15.0.2ad29ca7a4de6
on-headers@1.0.2
1.1.0
1
nightscout/cgm-remote-monitor:15.0.3f604dc4c03ca
on-headers@1.0.2
1.1.0
1
nodered/node-red:2.2.2e131dcadfe92
on-headers@1.0.2
1.1.0
1
nodered/node-red:3.0.2-18e2632a7a35dd
on-headers@1.0.2
1.1.0
1
nodered/node-red-docker:0.19.6-v8070643219ea2
on-headers@1.0.1
1.1.0
1
nonkronk/tristian-id:latest0a3694d70647
on-headers@1.0.2
1.1.0
1
ondrejsika/parking:latestb1fd497416c8
on-headers@1.0.2
1.1.0
1
ooghenekaro/amazon:latest03394ba1d6d8
on-headers@1.0.2
1.1.0
1
openhab/openhab-cloud:a8138a329dd2bac8c4b
on-headers@1.0.2
1.1.0
1
oryd/hydra-login-consent-node:v26.2.06465e95993b5
on-headers@1.0.2
1.1.0
1
patrickhulce/lhci-server:0.8.174b4b6a3954d
on-headers@1.0.2
1.1.0
1
phntom/codimd:2.4.31b9aafbb62e6
on-headers@1.0.2
1.1.0
1
polonel/trudesk:1.2.60cf6513f6fe3
on-headers@1.0.2
1.1.0
1
redis/redisinsight:2.68019fcf774631
on-headers@1.0.2
1.1.0
1
redis/redisinsight:2.46699d341bd329
on-headers@1.0.2
1.1.0
1
requarks/wiki:canary-2.5.2438b5865a7386c
on-headers@1.0.2
1.1.0
1
rlex/jsonvisio:1.9.5cd50ff65118e
on-headers@1.0.2
1.1.0
1
roadiehq/community-backstage-image:latestef355bf5b639
on-headers@1.0.2
1.1.0
1
samajh/alprfrontend:latest05ef4fddbb75
on-headers@1.0.2
1.1.0
1
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
on-headers@1.0.2
1.1.0
1
socialmediamacroscope/smile_graphql:0.3.1c5095e94bc65
on-headers@1.0.2
1.1.0
1
socialmediamacroscope/smile_server:0.3.31a528c794270
on-headers@1.0.1
1.1.0
1
soulou2019/node-server:latest5e6ecfcc109e
on-headers@1.0.2
1.1.0
1
speckle/speckle-server:2.17.14-branch.testing.72707.921a5f849d10dcdfb91
on-headers@1.0.2
1.1.0
1
speckle/speckle-server:2.19.2-branch.hotfix-2.19.1.124125-665e7e14b6a0750d5aa
on-headers@1.0.2
1.1.0
1
speckle/speckle-server:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb52f8eabf5cea
on-headers@1.0.2
1.1.0
1
speckle/speckle-server:2.20.2-branch.testing4.134160-9fad4b2687f43ab16f3
on-headers@1.0.2
1.1.0
1
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
on-headers@1.0.2
1.1.0
1
speckle/speckle-server:2.26.379f14a2bf931
on-headers@1.0.2
1.1.0
1
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
on-headers@1.0.2
1.1.0
1
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
on-headers@1.0.2
1.1.0
1
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
on-headers@1.0.2
1.1.0
1
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
on-headers@1.0.2
1.1.0
1
sqlpad/sqlpad:6.7d3d2f430dffd
on-headers@1.0.2
1.1.0
1
stanfordoval/almond-server:latest1a63cdccedaf
on-headers@1.0.2
1.1.0
1
svenwal/jsonplaceholder:latestba2f285af432
on-headers@1.0.2
1.1.0
1
testhubio/testhub-frontend:on-preme86c2db53be8
on-headers@1.0.2
1.1.0
1
th0th/node-red:4.0.3-debiand06fa39f7406
on-headers@1.0.2
1.1.0
1
thecodingmachine/workadventure-uploader:v1.17.73ccd467543b3
on-headers@1.0.2
1.1.0
1
thingsboard/tb-web-ui:3.4.157f98ed53b3d
on-headers@1.0.2
1.1.0
1
thingsboard/tb-web-ui:3.6.0d388378062cc
on-headers@1.0.2
1.1.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.