unhead vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-X7MM-9VVV-64W8Lowunhead: unhead: Streaming SSR `streamKey` injected into inline script without identifier validation CVE-2026-39315Mediumunhead: Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()CVE-2026-31873Lowunhead: Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity CVE-2026-31860Mediumunhead: Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo