Read the docs
TI-2026-59362 Aliases CVE-2026-86818GHSA-jvvf-x445-j334

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

Priority LOW 22CWE-172Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still percent-encoded, and decodes it only when storing it as a generic header, so a percent-encoded spelling of a reserved field name is not recognized as that field at parse time but is re-emitted as the literal field name when the parsed URI is serialized. An application that validates, logs, or displays the recipient list from the first parse and then serializes the URI and sends it can silently gain an attacker-chosen recipient, and the subject and body fields can be smuggled across the same roundtrip. The issue is fixed in fast-uri 4.1.5, and users should upgrade to 4.1.5 or later. As a workaround, do not act on a mailto URI that fast-uri has re-serialized without first decoding and re-validating its recipient, subject, and body fields.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00253 16th percentileScored 2026-11-07
Fix Partial fast-uri (fast-uri): 4.1.5fast-uri (npm): 4.1.5Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fast-urifast-uri4.1.3 to before 4.1.54.1.5Patch availableCNA
—fast-uri (npm)4.1.3 to before 4.1.54.1.5Patch availableGHSA-jvvf-x445-j334
  • fast-uri Vendorfast-uri Affected 4.1.3 to before 4.1.5 Fixed in 4.1.5 Patch available CNA
  • fast-uri (npm) Vendor— Affected 4.1.3 to before 4.1.5 Fixed in 4.1.5 Patch available GHSA-jvvf-x445-j334

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:openjsf:fast-uri:*:*:*:*:*:*:*:*——fast-uri
  • cpe:2.3:a:openjsf:fast-uri:*:*:*:*:*:*:*:* Versions — — ·fast-uri

Remediation

  • Fix · CNA fast-uri (fast-uri) Fixed in 4.1.5
  • Fix · GHSA-jvvf-x445-j334 fast-uri (npm) Fixed in 4.1.5 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 6AffectedNo fix yet: Fix deferred
Not affected: 34 products
  • Cost Management On Premise
  • Migration Toolkit for Applications 8
  • Migration Toolkit for Containers
  • Multicluster Engine for Kubernetes
  • Network Observability Operator
  • OpenShift Lightspeed
  • OpenShift Pipelines
  • OpenShift Serverless
  • Red Hat AMQ Broker 7
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ansible Automation Platform 2
  • Red Hat Build of Podman Desktop
  • Red Hat Data Grid 8
  • Red Hat Developer Hub 1
  • Red Hat Directory Server 11
  • Red Hat Directory Server 12
  • Red Hat Discovery 2
  • Red Hat Edge Manager 1
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Hardened Images
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces
  • Red Hat Openshift Data Foundation 4
  • Red Hat Quay 3
  • Red Hat Satellite 6
  • Red Hat build of Apache Camel - HawtIO 4
  • Red Hat build of Apicurio Registry 3
  • Secrets Management Console for Red Hat OpenShift
  • Self-service automation portal 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-86818
  2. 2026-10-03 Alias added: GHSA-jvvf-x445-j334
  3. 2026-10-27 Affected versions changed · Red Hat
  4. 2026-10-30 Affected versions changed · Red Hat

References

Advisory 1

Other 5

  • TI-2026-20392 WebdriverIO has Command Injection in the BrowserStack Service CVSS 3.1CRITICAL 9.8
  • TI-2022-08786 qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers… CVSS 3.1HIGH 7.5
  • TI-2026-09267 nvm executes commands from a malicious Node.js mirror's version strings CVSS 4.0HIGH 7.5
  • TI-2026-30143 Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping CVSS 3.1MEDIUM 6.4
  • TI-2025-32161 Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with… CVSS 3.1MEDIUM 5.5
  • TI-2024-09717 Preload arbitrary resources by injecting additional `Link` headers CVSS 3.1MEDIUM 5.3
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences