fix(finding): key repeated headers by occurrence, not by value

folding the value into the header key gave every multi-valued header a
distinct key, but it also destabilized the single-valued volatile ones.
Date rides on nearly every response, alongside ETag, Age, CF-Ray and
X-Request-Id, so each scan minted a fresh key and the diff/notify layer
reported them added+removed every run. Key is documented to be run-stable
(finding.go:41), so that was the wrong axis.

count occurrences of the header name instead. the two Set-Cookies still
split, Date and friends stay put.

the count is per name rather than the slice index: headers.go ranges over
resp.Header, so a name's slice position is randomized per run while the
order of values within one name is preserved.

Author: TBX3D

internal/finding/finding.go

@@ -20,6 +20,7 @@ package finding
 import (
 	"fmt"
 	"sort"
+	"strconv"
 	"strings"
 
 	"github.com/projectdiscovery/nuclei/v3/pkg/output"
@@ -481,16 +482,34 @@ func flattenProbe(target string, r *scan.ProbeResult) []Finding {
 
 func flattenHeaders(target string, rs []scan.HeaderResult) []Finding {
 	out := make([]Finding, 0, len(rs))
+	// a multi-valued header (Set-Cookie is the canonical case) emits one
+	// HeaderResult per value, and keying on the name alone collapses every
+	// value but the first onto one dedup Key. disambiguate by how many times
+	// the name has been seen rather than by the value: the value would
+	// destabilize every volatile single-valued header (Date, ETag, Age, CF-Ray)
+	// against the run-stable Key contract.
+	//
+	// the count is per name, not the slice index. headers.go ranges over
+	// resp.Header, so a name's position in the slice is randomized per run
+	// while the order of values within one name is preserved.
+	//
+	// the separator is ":", which rfc7230 excludes from a header field-name, so
+	// the suffix cannot collide with a real header. "#" would: it is a valid
+	// tchar, so a header literally named "Foo#1" would take the key of the
+	// second "Foo".
+	seen := make(map[string]int, len(rs))
 	for i := 0; i < len(rs); i++ {
 		h := rs[i]
-		// a multi-valued header (Set-Cookie is the canonical case) emits one
-		// HeaderResult per value; the value must ride in the identifier or
-		// every value but the first collapses onto one dedup Key.
+		identifier := h.Name
+		if n := seen[h.Name]; n > 0 {
+			identifier += ":" + strconv.Itoa(n)
+		}
+		seen[h.Name]++
 		out = append(out, Finding{
 			Target:   target,
 			Module:   "headers",
 			Severity: sevRecon,
-			Key:      key("headers", h.Name+":"+h.Value),
+			Key:      key("headers", identifier),
 			Title:    h.Name,
 			Raw:      h.Value,
 		})

internal/finding/finding_test.go

@@ -314,7 +314,7 @@ func TestFlattenStableKeysAndSeverities(t *testing.T) {
 			name:    "header is recon info",
 			value:   scan.HeaderResults{{Name: "Server", Value: "nginx"}},
 			module:  "headers",
-			wantKey: "headers:Server:nginx",
+			wantKey: "headers:Server",
 			wantSev: SeverityInfo,
 		},
 		{
@@ -396,6 +396,66 @@ func TestMultiValuedHeaderGetsDistinctKeys(t *testing.T) {
 	}
 }
 
+// Key is documented to be run-stable, so a header whose value changes every
+// response (Date is on nearly all of them, plus ETag/Age/CF-Ray/X-Request-Id)
+// must keep the same Key across scans. folding the value into the key would
+// churn a fresh key each run and make the diff/notify layer report every such
+// header as added+removed on every scan of every target.
+func TestVolatileHeaderKeyIsRunStable(t *testing.T) {
+	run1 := Flatten(target, "headers", []scan.HeaderResult{{Name: "Date", Value: "Mon, 07 Jul 2026 12:00:00 GMT"}})
+	run2 := Flatten(target, "headers", []scan.HeaderResult{{Name: "Date", Value: "Mon, 07 Jul 2026 12:00:01 GMT"}})
+	if run1[0].Key != run2[0].Key {
+		t.Fatalf("Date key churned across runs: %q then %q", run1[0].Key, run2[0].Key)
+	}
+}
+
+// the slice position of a header is randomized per run, so the disambiguator
+// must count occurrences within a name rather than use the slice index.
+func TestHeaderKeyIndependentOfEmissionOrder(t *testing.T) {
+	cookieA := scan.HeaderResult{Name: "Set-Cookie", Value: "session=aaa"}
+	cookieB := scan.HeaderResult{Name: "Set-Cookie", Value: "tracking=bbb"}
+	server := scan.HeaderResult{Name: "Server", Value: "nginx"}
+	date := scan.HeaderResult{Name: "Date", Value: "Mon, 07 Jul 2026 12:00:00 GMT"}
+
+	keysFor := func(rs []scan.HeaderResult) map[string]string {
+		got := make(map[string]string)
+		for _, f := range Flatten(target, "headers", rs) {
+			got[f.Raw] = f.Key
+		}
+		return got
+	}
+
+	// same headers, the map handed them to us in a different order.
+	first := keysFor([]scan.HeaderResult{server, cookieA, cookieB, date})
+	second := keysFor([]scan.HeaderResult{date, cookieA, cookieB, server})
+
+	for value, key := range first {
+		if second[value] != key {
+			t.Errorf("header %q key changed with emission order: %q then %q", value, key, second[value])
+		}
+	}
+	if first["session=aaa"] == first["tracking=bbb"] {
+		t.Fatalf("the two Set-Cookie values still share key %q", first["session=aaa"])
+	}
+}
+
+// the occurrence suffix must use a separator that cannot appear in a header
+// field-name, or it collides with a real header of that literal name.
+func TestHeaderOccurrenceSuffixCannotCollide(t *testing.T) {
+	fs := Flatten(target, "headers", []scan.HeaderResult{
+		{Name: "Foo", Value: "first"},
+		{Name: "Foo", Value: "second"},
+		{Name: "Foo#1", Value: "a genuinely different header"},
+	})
+	seen := make(map[string]string, len(fs))
+	for _, f := range fs {
+		if prev, dup := seen[f.Key]; dup {
+			t.Errorf("key collision on %q: %q and %q", f.Key, prev, f.Raw)
+		}
+		seen[f.Key] = f.Raw
+	}
+}
+
 func TestJSEnvVarOrderingIsStable(t *testing.T) {
 	res := &js.JavascriptScanResult{
 		FoundEnvironmentVars: map[string]string{