Unjs maintains a modestly represented portfolio of JavaScript utility and server-infrastructure libraries—including Unhead, Defu, IPX, and Nanotar—that serve as building blocks in web frameworks and development toolchains. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes and recur through input-handling weakness classes including path traversal, cross-site scripting, prototype pollution, and incomplete input validation, patterns that reflect the attack surface of parser-facing and object-manipulation code in the Node.js ecosystem. Defenders should prioritize inventory of downstream projects that depend on these libraries, since even a single critical flaw propagates through the supply chain; live severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Unjs over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-69874CRITICAL nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary files outside the intended extraction dire | Feb 11, 2026 | 9.8 | 30 | NO | NO |
CVE-2025-54387CRITICAL IPX is an image optimizer powered by sharp and svgo. In versions 1.3.1 and below, 2.0.0-0 through 2.1.0, and 3.0.0 through 3.1.0, the approach used to check whether a path is withi | Aug 5, 2025 | 9.8 | 30 | NO | NO |
CVE-2026-35209HIGH defu is software that allows uers to assign default properties recursively. Prior to version 6.1.5, applications that pass unsanitized user input (e.g. parsed JSON request bodies, | Apr 6, 2026 | 7.5 | 29 | NO | NO |
CVE-2026-31860MEDIUM Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered <hea | Mar 12, 2026 | 6.1 | 22 | NO | NO |
CVE-2026-39315MEDIUM Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe() is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied con | Apr 9, 2026 | 6.1 | 21 | NO | NO |
CVE-2026-31873MEDIUM Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe (safe.ts) uses String.includes(), which is case-sensitive. Browsers treat URI sc | Mar 12, 2026 | 6.1 | 21 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Unjs.
Media articles that mention a CVE ID that affects a product developed by Unjs — matched by CVE ID, not by vendor name.