package

npm/unhead

pkg:npm/unhead

—0.0npm

Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity

Modified: 3/14/2026

MEDIUM6.1npm

Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()

Modified: 4/9/2026

MEDIUMnpm

Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check

Modified: 3/14/2026

LOWnpm

unhead: Streaming SSR `streamKey` injected into inline script without identifier validation

Modified: 4/10/2026