Skip to main content
cve.nowby Sazabi
← npm
npmPackage

unhead

3 known vulnerabilities (2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 2 medium
Registry
npm

Advisories 3

  • CVE-2026-39315Medium 6.1

    Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()

    Affected: fixed in 2.1.13.

  • Unhead has a Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity

    Affected: fixed in 2.1.11.

  • CVE-2026-31860Medium 5.3

    Unhead has a XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check

    Affected: fixed in 2.1.11.