AIKIDO-2026-10361

TL;DR

Affected versions of this package are affected by a prototype pollution vulnerability in unhead. Insufficient validation when merging user-controlled objects into internal configuration structures allows specially crafted property names such as __proto__ to modify the prototype of JavaScript objects. This could allow an attacker to inject arbitrary properties into the global object prototype, potentially influencing application behavior and enabling further attacks depending on how polluted properties are later used. The issue is addressed by adding safeguards to prevent prototype keys from being merged into internal objects.