{"action":"Upgrade unhead to 2.1.11 or later.","affected":[{"fixed":"2.1.11","introduced":"0"}],"component":"unhead","cve_ids":["CVE-2026-31873"],"ecosystem":"npm","epss":0.00241,"exploited":false,"fixed_versions":["2.1.11"],"ghsa_id":"GHSA-5339-hvwr-7582","id":"tcs_01M5KF29KFY83275S46THW06BX","modified_at":"2026-03-14T06:26:21.006093Z","published_at":"2026-03-12T14:19:25Z","references":["https://osv.dev/vulnerability/GHSA-5339-hvwr-7582","https://github.com/unjs/unhead/security/advisories/GHSA-5339-hvwr-7582","https://nvd.nist.gov/vuln/detail/CVE-2026-31873","https://github.com/unjs/unhead","https://github.com/unjs/unhead/releases/tag/v2.1.11"],"severity":{"label":"unknown","score":0},"sources":[{"source":"osv","source_id":"GHSA-5339-hvwr-7582","url":"https://osv.dev/vulnerability/GHSA-5339-hvwr-7582"}],"summary":"Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity"}