CVE-2026-86818
fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still percent-encoded, and decodes it only when storing it as a generic header, so a percent-encoded spelling of a reserved field name is not recognized as that field at parse time but is re-emitted as the literal field name when the parsed URI is serialized. An application that validates, logs, or displays the recipient list from the first parse and then serializes the URI and sends it can silently gain an attacker-chosen recipient, and the subject and body fields can be smuggled across the same roundtrip. The issue is fixed in fast-uri 4.1.5, and users should upgrade to 4.1.5 or later. As a workaround, do not act on a mailto URI that fast-uri has re-serialized without first decoding and re-validating its recipient, subject, and body fields.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 4.8
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- EPSS probability
- 0.16%
- CWE
- CWE-172, CWE-436
- Published
- 2026-09-15
- Last modified
- 2026-09-15
Affected products
- fast-uri fast-uri
- fast-uri fast-uri
Weakness type
Related vulnerabilities
- CVE-2019-10160 — A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 af
- CVE-2025-27110 — Libmodsecurity3 has possible bypass of encoded HTML entities
- CVE-2019-12677 — Cisco Adaptive Security Appliance Software SSL VPN Denial of Service Vulnerability
- CVE-2026-42926 — NGINX ngx_http_proxy_v2_module vulnerability
- CVE-2019-10153 — A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment
- CVE-2026-48784 — Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
- CVE-2021-33604 — Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19
- CVE-2024-48909 — SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not