{"metadata": {"vulnerability": "CVE-2026-86818", "count": 16, "kinds": {"milestone": 5, "sighting": 2, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-09-08T13:53:37.286Z", "date_only": false, "value": "2026-09-08T13:53:37.286Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-86818", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-15T10:40:38.461Z", "date_only": false, "value": "2026-09-15T10:40:38.461Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-86818", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-15T10:40:38.461Z", "date_only": false, "value": "2026-09-15T10:40:38.461Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / openjs", "record": "CVE-2026-86818", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-15T10:44:46.300Z", "date_only": false, "value": "2026-09-15T10:44:46.300288Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mvkgykpd6s25", "record": "CVE-2026-86818", "field": "creation_timestamp", "uuid": "dc32e876-5702-41a4-bfee-3c7de48380d2", "content": "\ud83d\udea8 Medium-severity security fix in fast-uri@4.1.5 just released!\n\nPatches CVE-2026-86818: fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization\n\ngithub.com/fastify/fast...", "url": "https://bsky.app/profile/ulisesgascon.com/post/3mvkgykpd6s25"}, {"timestamp": "2026-09-15T11:17:00Z", "date_only": false, "value": "2026-09-15T11:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-86818", "record": "UBUNTU-CVE-2026-86818", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-15T11:17:12Z", "date_only": false, "value": "2026-09-15T11:17:12Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-JVVF-X445-J334", "record": "GHSA-JVVF-X445-J334", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-15T11:17:12.453Z", "date_only": false, "value": "2026-09-15T11:17:12.453", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-86818", "record": "FKIE_CVE-2026-86818", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-15T12:31:36.232Z", "date_only": false, "value": "2026-09-15T12:31:36.232672Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-86818", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-15T12:31:36.232Z", "date_only": false, "value": "2026-09-15T12:31:36.232672Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-86818", "record": "FKIE_CVE-2026-86818", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-15T12:31:55.631Z", "date_only": false, "value": "2026-09-15T12:31:55.631Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-86818", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-15T12:31:55.631Z", "date_only": false, "value": "2026-09-15T12:31:55.631Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-86818", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-16T19:40:00.317Z", "date_only": false, "value": "2026-09-16T19:40:00.317", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-86818", "record": "FKIE_CVE-2026-86818", "field": "lastModified"}, {"timestamp": "2026-09-29T23:51:16Z", "date_only": false, "value": "2026-09-29T23:51:16Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-JVVF-X445-J334", "record": "GHSA-JVVF-X445-J334", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-29T23:51:16Z", "date_only": false, "value": "2026-09-29T23:51:16Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-JVVF-X445-J334", "record": "GHSA-JVVF-X445-J334", "field": "modified"}, {"timestamp": "2026-09-30T02:30:32Z", "date_only": false, "value": "2026-09-30T02:30:32.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/89d3507c8c393d749b4b3b6359dfa06b", "record": "cve-2026-86818", "field": "creation_timestamp", "uuid": "b49a21d5-ff38-4180-b4f8-631f1eefe61c", "content": "# CVE-2026-86818: CVE-2026-86818: Mailto Header Injection via Percent-Encoded Field-Name Desynchronization in fast-uri\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-86818\n\n## Summary\nA security-critical desynchronization vulnerability exists in fast-uri versions 4.1.3 and 4.1.4. Due to incorrect order-of-operations, the mailto scheme parser validates raw percent-encoded parameter keys instead of normalized keys, but subsequently decodes and writes them into a generic headers object. When the parsed URI is serialized, these keys are re-emitted literally, allowing attackers to bypass validation boundaries and smuggle unauthorized recipients, subjects, or body parameters in downstream mailing applications.\n\n## TL;DR\nA validation discrepancy in fast-uri allows remote attackers to smuggle mailto parameters such as 'to', 'subject', and 'body' by using percent-encoded names like '%74o', bypassing safety validations before serialization.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-172 / CWE-436\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 4.8\n- **Exploitability Subscore**: 2.2\n- **Impact Subscore**: 2.5\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- fast-uri versions 4.1.3 and 4.1.4\n- Node.js applications parsing mailto schemas with fast-uri\n- Downstream packages containing transient dependencies on fast-uri v4.1.3/v4.1.4, including Fastify and ajv\n- **fast-uri**: >= 4.1.3, <= 4.1.4 (Fixed in: `4.1.5`)\n\n## Mitigation\n\n- Upgrade fast-uri dependency to version 4.1.5 or newer\n- Enforce dependency overrides or resolutions in package.json to update transitive fast-uri instances in Fastify and ajv\n- Implement a pre-serialization filter that manually purges reserved keys from parsed.headers\n\n**Remediation Steps:**\n1. Scan the project node_modules using 'npm ls fast-uri' to identify vulnerable versions\n2. Add overrides for fast-uri version 4.1.5 inside the project package.json file\n3. Re-generate the lockfile using 'npm install' or 'yarn install' to apply the resolution\n4. Verify that validation logic parses and serializes mailto links correctly using the updated package\n\n## References\n\n- [GHSA-jvvf-x445-j334: mailto header/parameter injection via percent-encoded field-name desynchronization](https://github.com/fastify/fast-uri/security/advisories/GHSA-jvvf-x445-j334)\n- [NVD - CVE-2026-86818 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-86818)\n- [CVE.org Record - CVE-2026-86818](https://www.cve.org/CVERecord?id=CVE-2026-86818)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n- [fast-uri Release v4.1.5](https://github.com/fastify/fast-uri/releases/tag/v4.1.5)\n- [Wiz Vulnerability Database: CVE-2026-86818](https://www.wiz.io/vulnerability-database/cve/cve-2026-86818)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-86818) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/89d3507c8c393d749b4b3b6359dfa06b"}, {"timestamp": "2026-10-28T17:43:55Z", "date_only": false, "value": "2026-10-28T17:43:55Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-86818", "record": "UBUNTU-CVE-2026-86818", "field": "modified"}], "metrics": {"as_of": "2026-10-30T11:55:02.564Z", "anchors": {"origin": {"timestamp": "2026-09-15T10:40:38.461Z", "date_only": false, "value": "2026-09-15T10:40:38.461Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-86818", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-09-15T10:40:38.461Z", "date_only": false, "value": "2026-09-15T10:40:38.461Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-86818", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 3892464.103479, "hours": 1081.2400287441667, "days": 45.051667864340274, "min_seconds": 3892464.103479, "max_seconds": 3892464.103479, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-15T10:40:38.461Z", "date_only": false, "value": "2026-09-15T10:40:38.461Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-86818", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-30T11:55:02.564Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}