{"uuid": "f5ba5b7a-ce2a-499b-90ad-3c892cea320e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-jvvf-x445-j334", "type": "seen", "source": "https://gist.github.com/alon710/89d3507c8c393d749b4b3b6359dfa06b", "content": "# CVE-2026-86818: CVE-2026-86818: Mailto Header Injection via Percent-Encoded Field-Name Desynchronization in fast-uri\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-86818\n\n## Summary\nA security-critical desynchronization vulnerability exists in fast-uri versions 4.1.3 and 4.1.4. Due to incorrect order-of-operations, the mailto scheme parser validates raw percent-encoded parameter keys instead of normalized keys, but subsequently decodes and writes them into a generic headers object. When the parsed URI is serialized, these keys are re-emitted literally, allowing attackers to bypass validation boundaries and smuggle unauthorized recipients, subjects, or body parameters in downstream mailing applications.\n\n## TL;DR\nA validation discrepancy in fast-uri allows remote attackers to smuggle mailto parameters such as 'to', 'subject', and 'body' by using percent-encoded names like '%74o', bypassing safety validations before serialization.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-172 / CWE-436\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 4.8\n- **Exploitability Subscore**: 2.2\n- **Impact Subscore**: 2.5\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- fast-uri versions 4.1.3 and 4.1.4\n- Node.js applications parsing mailto schemas with fast-uri\n- Downstream packages containing transient dependencies on fast-uri v4.1.3/v4.1.4, including Fastify and ajv\n- **fast-uri**: >= 4.1.3, <= 4.1.4 (Fixed in: `4.1.5`)\n\n## Mitigation\n\n- Upgrade fast-uri dependency to version 4.1.5 or newer\n- Enforce dependency overrides or resolutions in package.json to update transitive fast-uri instances in Fastify and ajv\n- Implement a pre-serialization filter that manually purges reserved keys from parsed.headers\n\n**Remediation Steps:**\n1. Scan the project node_modules using 'npm ls fast-uri' to identify vulnerable versions\n2. Add overrides for fast-uri version 4.1.5 inside the project package.json file\n3. Re-generate the lockfile using 'npm install' or 'yarn install' to apply the resolution\n4. Verify that validation logic parses and serializes mailto links correctly using the updated package\n\n## References\n\n- [GHSA-jvvf-x445-j334: mailto header/parameter injection via percent-encoded field-name desynchronization](https://github.com/fastify/fast-uri/security/advisories/GHSA-jvvf-x445-j334)\n- [NVD - CVE-2026-86818 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-86818)\n- [CVE.org Record - CVE-2026-86818](https://www.cve.org/CVERecord?id=CVE-2026-86818)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n- [fast-uri Release v4.1.5](https://github.com/fastify/fast-uri/releases/tag/v4.1.5)\n- [Wiz Vulnerability Database: CVE-2026-86818](https://www.wiz.io/vulnerability-database/cve/cve-2026-86818)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-86818) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T02:30:32.000000Z"}