u
unjs
Security Risk Profile
44
/100
mediumSecurity Risk Score
Comprehensive risk assessment based on 6 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from August 4, 2025 to present
6
Total CVEs
2
Critical+High
0
Exploited
1
Unpatched
Threat Assessment
Avg CVSS
7
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
1
Critical/High
Risk Level
44/100
medium
Severity Distribution
Critical
1High
1Medium
4Low
0Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
2Age Distribution
Common Weaknesses (CWE)
1
XSS
3
2
Path Traversal
2
3
Input Validation
1
Most Affected Products
1. npm/unhead3
2. npm/ipx3
3. unjs Ipx Node.js3
4. unjs Unhead2
5. npm/nanotar2
Recent Vulnerabilities
See more →CVE-2026-39315
CVSS 6.1medium
Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()
Apr 9, 2026
CVE-2026-35209
CVSS 7.5high
defu: Prototype pollution via `__proto__` key in defaults argument
Apr 4, 2026
CVE-2026-31873
CVSS 6.1EPSS 0%medium
Unhead has a Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity
Mar 12, 2026
CVE-2026-31860
CVSS 5.3EPSS 0%medium
Unhead has a XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check
Mar 12, 2026
CVE-2025-69874
CVSS 9.8critical
Feb 11, 2026🔧 No Patch
CVE-2025-54387
CVSS 6.9medium
IPX is Vulnerable to Path Traversal via Prefix Matching Bypass
Aug 4, 2025
Monitor unjs in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.