{"id":"CVE-2026-86818","aliases":["GHSA-jvvf-x445-j334"],"url":"https://o3.security/vulnerability/CVE-2026-86818","summary":"fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization","details":"### Impact\n\n`fast-uri`'s `mailto` scheme parser compares each query field name to the reserved names (`to`, `subject`, `body`) while the name is still percent-encoded, and only percent-decodes it when storing it as a generic header. On serialize, the decoded name is re-emitted, so a field name such as `%74o` (percent-encoded `to`) is not recognized as a recipient at parse time (`parse().to` shows only the legitimate recipient) but materializes as a literal `to=` field after `serialize()`, and reparsing then treats it as a recipient. The same technique smuggles `subject` and `body` through `%73ubject` and `%62ody`.\n\nAn application that parses an untrusted mailto URI, makes a display, allowlist, or logging decision on `parse().to`, then re-serializes the result and passes the serialized string to a mail client or an outbound send path can gain an attacker-chosen recipient, subject, or body that was not visible when the recipient list was checked. A scanner inspecting the raw input for an extra `to=` sees nothing, because the injected field appears only after `fast-uri` serializes.\n\n### Patches\n\nUpgrade to `fast-uri` 4.1.5.\n\n### Workarounds\n\nPercent-decode and compare mailto field names case-insensitively before trusting `parse().to`, or re-check the recipient list on the serialized output rather than only on the initial parse, until upgrading.","published":"2026-09-15T10:40:38.461Z","modified":"2026-10-21T03:00:34.530780164Z","cvss":{"score":4.8,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"fast-uri","fixedVersion":"4.1.5"}],"fix":{"url":"https://github.com/fastify/fast-uri/commit/f40a88f33e684a46faec3f5b820bcbb1e85add64","label":"fastify/fast-uri@f40a88f"},"references":[{"type":"ADVISORY","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86818.json"},{"type":"ADVISORY","url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-jvvf-x445-j334"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86818"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/f40a88f33e684a46faec3f5b820bcbb1e85add64"},{"type":"PACKAGE","url":"https://github.com/fastify/fast-uri"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v4.1.5"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T03:00:34.530780164Z"}}