Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()

Description

##EVIDENCE

<img width=”1919” height=”947” alt=”Screenshot_2026-03-25_090715” src=”https://github.

Recommendation

Update the unhead package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.1.13
• Patched version(s): 2.1.13

References

• GHSA-95h2-gj7x-gx9w
• CVE-2026-39315
• CWE-184
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6