What is it?
This HTTP header finding means the response exposes detailed server or framework version information through headers such as Server, X-Powered-By, X-AspNet-Version, or X-Generator.
Why does it matter?
Version banners can help attackers identify known vulnerable software faster. Hiding versions is not a substitute for patching, but reducing precise exposure lowers unnecessary reconnaissance value.
How to fix it?
Disable detailed version tokens in the web server, framework, CDN, or application configuration.
server_tokens off;For Express applications:
app.disable("x-powered-by");Keep software patched even when banners are hidden. If a managed platform always emits a generic header, treat that as lower risk than exposing exact versions.