Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-86818— fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

Quick assessment

Affected
fast-uri fast-uri
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

fast-uri 是一个无依赖、符合 RFC 3986 标准的 URI 解析器，用于 Node.js 环境，被 Fastify 和 ajv 所使用。该库在 4.1.3 版本中新增了对 mailto 协议的解析支持。 在 4.1.3 和 4.1.4 版本中，mailto 解析器在查询字段的名称仍为百分号编码状态时，就将其与保留字段名 、 和 进行比对；只有当将其作为通用 header 存储时才会对其进行解码。这导致以百分号编码形式出现的保留字段名在解析时无法被正确识别为对应字段，但在序列化已解析的 URI 时，该编码

CVSS 4.8 · Medium EPSS 0.16% · P6

Affected Version Matrix 2

VendorProduct Version RangeStatus
fast-uri fast-uri 4.1.3< 4.1.5 affected
4.1.5 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-86818

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization
Source: CVE Program / CVE List V5
Vulnerability Description
fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still percent-encoded, and decodes it only when storing it as a generic header, so a percent-encoded spelling of a reserved field name is not recognized as that field at parse time but is re-emitted as the literal field name when the parsed URI is serialized. An application that validates, logs, or displays the recipient list from the first parse and then serializes the URI and sends it can silently gain an attacker-chosen recipient, and the subject and body fields can be smuggled across the same roundtrip. The issue is fixed in fast-uri 4.1.5, and users should upgrade to 4.1.5 or later. As a workaround, do not act on a mailto URI that fast-uri has re-serialized without first decoding and re-validating its recipient, subject, and body fields.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
编码错误
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
fast-uri fast-uri 4.1.3 ~ 4.1.5 -

II. Public POCs for CVE-2026-86818

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-86818

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-86818 (1)

IV. Related Vulnerabilities

Same product: fast-uri
Same vendor: fast-uri
Same weakness: CWE-172

V. Comments for CVE-2026-86818

No comments yet

Leave a comment