{"id":"GHSA-jvvf-x445-j334","summary":"fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization","details":"### Impact\n\n`fast-uri`'s `mailto` scheme parser compares each query field name to the reserved names (`to`, `subject`, `body`) while the name is still percent-encoded, and only percent-decodes it when storing it as a generic header. On serialize, the decoded name is re-emitted, so a field name such as `%74o` (percent-encoded `to`) is not recognized as a recipient at parse time (`parse().to` shows only the legitimate recipient) but materializes as a literal `to=` field after `serialize()`, and reparsing then treats it as a recipient. The same technique smuggles `subject` and `body` through `%73ubject` and `%62ody`.\n\nAn application that parses an untrusted mailto URI, makes a display, allowlist, or logging decision on `parse().to`, then re-serializes the result and passes the serialized string to a mail client or an outbound send path can gain an attacker-chosen recipient, subject, or body that was not visible when the recipient list was checked. A scanner inspecting the raw input for an extra `to=` sees nothing, because the injected field appears only after `fast-uri` serializes.\n\n### Patches\n\nUpgrade to `fast-uri` 4.1.5.\n\n### Workarounds\n\nPercent-decode and compare mailto field names case-insensitively before trusting `parse().to`, or re-check the recipient list on the serialized output rather than only on the initial parse, until upgrading.","aliases":["CVE-2026-86818"],"modified":"2026-09-30T00:00:03.854518772Z","published":"2026-09-29T23:51:16Z","database_specific":{"nvd_published_at":"2026-09-15T11:17:12Z","cwe_ids":["CWE-172","CWE-436"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-09-29T23:51:16Z"},"references":[{"type":"WEB","url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-jvvf-x445-j334"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86818"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/f40a88f33e684a46faec3f5b820bcbb1e85add64"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/fastify/fast-uri"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v4.1.5"}],"affected":[{"package":{"name":"fast-uri","ecosystem":"npm","purl":"pkg:npm/fast-uri"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.1.3"},{"fixed":"4.1.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-jvvf-x445-j334/GHSA-jvvf-x445-j334.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}