Skip to content
unjs
Products
| Product | CVEs | Exploited | Latest |
|---|
| unhead | 3 | – | Apr 9, 2026 |
| defu | 1 | – | Apr 6, 2026 |
| ipx | 1 | – | Aug 5, 2025 |
Exploited and recent CVEs
-
CVE-2026-39315
Medium 6.1
Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()
0.3%
-
CVE-2026-35209
High 7.5
defu: Prototype pollution via `__proto__` key in defaults argument
0.4%
-
CVE-2026-31873
None 0.0
Unhead has a Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity
0.2%
-
CVE-2026-31860
Medium 5.3
Unhead has a XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check
0.3%
-
CVE-2025-54387
Medium 6.9
IPX is Vulnerable to Path Traversal via Prefix Matching Bypass
0.8%