CVE-2026-39315

Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in...

@syora/core (>=0.1.0-alpha.1, <=1.0.0-alpha.2), @unhead/angular (>=3.0.0-beta.5, <=3.0.0) +5 more potentially affected by unknown CVE via unhead (>=3.0.0-beta.5, <=3.0.0)

unhead NPM version =3.0.0-beta.5, =0.1.0-alpha.1, =3.0.0-beta.5, =3.0.0-beta.5, =3.0.0-beta.5, =3.0.0-beta.5, =3.0.0-beta.5, =3.0.0-beta.5, =3.0.0 Source cves: unknown CVE Source advisory: GHSA-X7MM-9VVV-64W8...

unhead: Streaming SSR `streamKey` injected into inline script without identifier validation

Summary createStreamableHead streamKey interpolated its streamKey argument directly into the streaming SSR bootstrap and suspense-chunk inline scripts without identifier validation or escaping. If an application forwards untrusted data into that configuration value, the rendered scripts become a...

@syora/core (>=0.1.0-alpha.1, <=1.0.0-alpha.2), @unhead/angular (>=3.0.0-beta.5, <=3.0.0) +5 more potentially affected by unknown CVE via unhead (>=3.0.0-beta.5, <=3.0.0)

unhead NPM version =3.0.0-beta.5, =0.1.0-alpha.1, =3.0.0-beta.5, =3.0.0-beta.5, =3.0.0-beta.5, =3.0.0-beta.5, =3.0.0-beta.5, =3.0.0-beta.5, =3.0.0 Source cves: unknown CVE Source advisory: OSV:GHSA-X7MM-9VVV-64W8...

@syora/core (>=0.1.0-alpha.1, <=1.0.0-alpha.2), @unhead/angular (>=3.0.0-beta.5, <=3.0.0) +5 more potentially affected by unknown CVE via unhead (>=3.0.0-beta.5, <=3.0.0)

unhead NPM version =3.0.0-beta.5, =0.1.0-alpha.1, =3.0.0-beta.5, =3.0.0-beta.5, =3.0.0-beta.5, =3.0.0-beta.5, =3.0.0-beta.5, =3.0.0-beta.5, =3.0.0 Source cves: unknown CVE Source advisory: SNYK:JS-UNHEAD-15989796...

Cross-site Scripting (XSS)

Overview unhead is a Full-stack manager built for any framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the streamKey configuration parameter on the streaming server-side. An attacker can execute arbitrary JavaScript code in the context of the rendered pa...

PT-2026-33905

Summary createStreamableHead streamKey interpolated its streamKey argument directly into the streaming SSR bootstrap and suspense-chunk inline scripts without identifier validation or escaping. If an application forwards untrusted data into that configuration value, the rendered scripts become a...

GHSA-95H2-GJ7X-GX9W Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()

EVIDENCE | Disclosed to Vercel H1 | 2026-03-22 no response after 12 days | | Cross-reported here | 2026-04-03 | --- Summary useHeadSafe is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in safely. Internally, the hasDangerousProtocol functio...

@saasmakers/ui (>=0.1.88, <=2.1.8), @styleframe/docs (>=1.1.0, <=2.0.1) +12 more potentially affected by CVE-2026-39315 via unhead (>=2.0.0-alpha.0, <=2.1.12)

unhead NPM version =2.0.0-alpha.0, =0.1.88, =1.1.0, =2.0.0-alpha.19, =2.0.0-alpha.9, =2.0.0-alpha.0, =2.0.0-alpha.18, =2.0.0-alpha.17, =2.0.0-alpha.0, =1.2.0, =0.0.2, =0.17.0, =2.0.0-alpha.8, =0.1.0-beta.10, =0.1.0-beta.14 Source cves: CVE-2026-39315 Source advisory: OSV:GHSA-95H2-GJ7X-GX9W...

@saasmakers/ui (>=0.1.88, <=2.1.8), @styleframe/docs (>=1.1.0, <=2.0.1) +12 more potentially affected by CVE-2026-39315 via unhead (>=2.0.0-alpha.0, <=2.1.12)

unhead NPM version =2.0.0-alpha.0, =0.1.88, =1.1.0, =2.0.0-alpha.19, =2.0.0-alpha.9, =2.0.0-alpha.0, =2.0.0-alpha.18, =2.0.0-alpha.17, =2.0.0-alpha.0, =1.2.0, =0.0.2, =0.17.0, =2.0.0-alpha.8, =0.1.0-beta.10, =0.1.0-beta.14 Source cves: CVE-2026-39315 Source advisory: GHSA-95H2-GJ7X-GX9W...

Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()

EVIDENCE | Disclosed to Vercel H1 | 2026-03-22 no response after 12 days | | Cross-reported here | 2026-04-03 | --- Summary useHeadSafe is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in safely. Internally, the hasDangerousProtocol functio...

Incomplete List of Disallowed Inputs

Overview unhead is a Full-stack manager built for any framework. Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the hasDangerousProtocol function though the usage of HtmlEntityHex and HtmlEntityDec RegExp. An attacker can inject malicious URIs into the...

Incomplete List of Disallowed Inputs

Overview org.webjars.npm:unhead is a Full-stack manager built for any framework. Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the hasDangerousProtocol function though the usage of HtmlEntityHex and HtmlEntityDec RegExp. An attacker can inject malicio...

@saasmakers/ui (>=0.1.88, <=2.1.8), @styleframe/docs (>=1.1.0, <=2.0.1) +12 more potentially affected by CVE-2026-39315 via unhead (>=2.0.0-alpha.0, <=2.1.12)

unhead NPM version =2.0.0-alpha.0, =0.1.88, =1.1.0, =2.0.0-alpha.19, =2.0.0-alpha.9, =2.0.0-alpha.0, =2.0.0-alpha.18, =2.0.0-alpha.17, =2.0.0-alpha.0, =1.2.0, =0.0.2, =0.17.0, =2.0.0-alpha.8, =0.1.0-beta.10, =0.1.0-beta.14 Source cves: CVE-2026-39315 Source advisory: SNYK:JS-UNHEAD-15965923...

CVE-2026-39315

Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in safely. Internally, the hasDangerousProtocol function in packages/unhead/src/plugins/safe.ts decodes HTML...

CVE-2026-39315 Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()

Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in safely. Internally, the hasDangerousProtocol function in packages/unhead/src/plugins/safe.ts decodes HTML...

CVE-2026-39315

Unhead (document head/template manager) contains a vulnerability in useHeadSafe() where hasDangerousProtocol() decodes HTML entities before blocked-scheme checks. The decoder uses two fixed-width regexes; HTML5 allows leading zeros in numeric character references, and when a padded entity exceeds...

CVE-2026-39315 Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()

Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in safely. Internally, the hasDangerousProtocol function in packages/unhead/src/plugins/safe.ts decodes HTML...

CVE-2026-39315

Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in...

CVE-2026-39315

Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in safely. Internally, the hasDangerousProtocol function in packages/unhead/src/plugins/safe.ts decodes HTML...