npm/unhead CVE-2026-39315: medium 6.1, EPSS 0.34%

Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()

Action: Upgrade unhead to 2.1.13 or later.

npm i unhead@2.1.13

Affected

Fixed versions

Sources

• osv: GHSA-95h2-gj7x-gx9w
• https://github.com/unjs/unhead/security/advisories/GHSA-95h2-gj7x-gx9w
• https://nvd.nist.gov/vuln/detail/CVE-2026-39315
• https://github.com/unjs/unhead/commit/961ea781e091853812ffe17f8cda17105d2d2299
• https://github.com/unjs/unhead
• https://github.com/unjs/unhead/releases/tag/v2.1.13

CVE-2026-39315 · published 2026-04-09T20:28:05Z · modified 2026-04-09T20:41:24.335154Z · JSON