CVE-2026-31873: Unhead Package Vulnerable to URI Scheme Bypass via Case-Sensitivity
Summary
CVE-2026-31873: Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity. Affects unhead versions < 2.1.11. Fixed in 2.1.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Unhead package is a lightweight library used for managing head elements in web applications, allowing developers to dynamically manipulate the document head. It provides features for adding, updating, and removing elements like scripts and stylesheets. However, a vulnerability exists in its URI scheme sanitization process, which can be exploited to bypass security checks.
Vulnerability Detail
The vulnerability arises from the makeTagSafe function in the Unhead package, specifically in how it checks the link.href property. The check uses String.includes(), which is case-sensitive. This means that while browsers treat URI schemes like 'data:' and 'DATA:' as equivalent, the function does not. An attacker can exploit this by injecting a URI with a case variation, allowing them to load arbitrary CSS, leading to potential UI redressing or data exfiltration through CSS attribute selectors.
How To Fix
Minimum fixed version
2.1.11
This is the first release that contains the fix.
npm install unhead@2.1.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider implementing a temporary workaround by modifying the makeTagSafe function in your local copy of the Unhead package. Change the code as follows:
if (key === 'href') {
const lower = val.toLowerCase();
if (lower.includes('javascript:') || lower.includes('data:')) {
return;
}
next[key] = val;
}
Conclusion
The CVE-2026-31873 vulnerability in the Unhead package poses a significant risk due to improper URI scheme sanitization. It is crucial to update to the patched version or implement the suggested workaround to mitigate potential attacks.
See every vulnerability recorded for unhead →
FAQ
The vulnerability allows attackers to bypass URI scheme checks due to case sensitivity, enabling them to inject malicious CSS.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities.
The vulnerability can lead to UI redressing attacks or data exfiltration through CSS, compromising user data and application integrity.
Yes, updating to Unhead version 2.1.11 or later resolves the vulnerability by making the URI scheme checks case-insensitive.
You can implement a temporary workaround by modifying the makeTagSafe function as described in the workaround section.
Related vulnerabilities
Recent vulnerabilities recorded for unhead.
