EUVD-2026-11639

Unhead has XSS bypass in useHeadSafe via attribute name injection and case-sensitive protocol check...