Is CVE-2026-31873 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-31873 being exploited in the wild.

How severe is CVE-2026-31873?

Low severity, with a CVSS score of 3.1, published 12 March 2026.

Which products and versions are affected?

unhead (npm) SEMVER:introduced=0,fixed=2.1.11.

Is there a fix for CVE-2026-31873?

Yes. unhead (npm): upgrade to 2.1.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-31873 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-31873?

Check whether you run unhead (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-31873: Unhead URI scheme sanitization bypass via case-sensitivity

CVE-2026-31873 · Severity: low · CVSS 3.1 · Published 2026-03-12

Unhead is a package that manages HTML head tags for web frameworks. A vulnerability in its safety sanitizer allows attackers to bypass protections against malicious links by using different letter casings (e.g., "DATA:" instead of "data:"). This can lead to injection of malicious CSS or JavaScript that affects page rendering or steals user data, though actual impact is limited by the lack of direct execution privileges.

Technologies: unhead (npm). Vendors: npm.

Quick answers

Is CVE-2026-31873 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-31873 being exploited in the wild.
How severe is CVE-2026-31873?: Low severity, with a CVSS score of 3.1, published 12 March 2026.
Which products and versions are affected?: unhead (npm) SEMVER:introduced=0,fixed=2.1.11.
Is there a fix for CVE-2026-31873?: Yes. unhead (npm): upgrade to 2.1.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-31873 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-31873?: Check whether you run unhead (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

unhead (npm): upgrade to 2.1.11 or later
```
npm install unhead@2.1.11
```

Technical details

The vulnerability is a case-sensitivity bypass in the makeTagSafe function (safe.ts, lines 68-71), which uses String.includes() to block 'javascript:' and 'data:' URI schemes in href attributes. Since JavaScript's includes() method is case-sensitive but browsers parse URI schemes case-insensitively, an attacker can bypass the filter using alternate casings like 'DATA:', 'JAVASCRIPT:', or 'dAtA:'. An attacker providing untrusted input to useHeadSafe() can inject arbitrary CSS (via data: URIs) for UI redressing or attribute selector-based exfiltration. The fix involves converting the href value to lowercase before performing the scheme check. The vulnerability was patched in version 2.1.11; affected versions are ≤2.1.10.

Affected products

unjs unhead <=2.1.10

Identifiers

CVE-2026-31873
GHSA-5339-hvwr-7582

Timeline

2026-03-12: disclosed
2026-03-12: patched: Fixed in version 2.1.11

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.