CVE-2026-86818
Received Received - Intake

Path Traversal in fast-uri URI Parser

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: openjs

Description
fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still percent-encoded, and decodes it only when storing it as a generic header, so a percent-encoded spelling of a reserved field name is not recognized as that field at parse time but is re-emitted as the literal field name when the parsed URI is serialized. An application that validates, logs, or displays the recipient list from the first parse and then serializes the URI and sends it can silently gain an attacker-chosen recipient, and the subject and body fields can be smuggled across the same roundtrip. The issue is fixed in fast-uri 4.1.5, and users should upgrade to 4.1.5 or later. As a workaround, do not act on a mailto URI that fast-uri has re-serialized without first decoding and re-validating its recipient, subject, and body fields.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-86818
EUVD
EUVD-2026-78403

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-172 The product does not properly encode or decode the data, resulting in unexpected values.
CWE-436 Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the fast-uri library in Node.js, specifically versions 4.1.3 and 4.1.4. It involves a mailto URI parser that incorrectly handles percent-encoded field names like 'to', 'subject', and 'body'. The parser compares these names in encoded form but only decodes them later, allowing attackers to bypass checks by using encoded spellings such as %74o (which becomes 'to' when decoded). This can lead to unintended recipients or hidden subject/body content when the URI is re-serialized and sent.

Detection Guidance

To detect this vulnerability, check if your system uses fast-uri versions 4.1.3 or 4.1.4. Run: npm list fast-uri or npm list -g fast-uri. If the version is within the vulnerable range, the system is potentially affected.

Impact Analysis

If you use an affected version of fast-uri to parse untrusted mailto URIs, an attacker could inject malicious recipients, subjects, or body content. Applications that validate or log recipient lists based on the initial parse and then re-serialize the URI may unknowingly send emails to unintended parties or include hidden content. This could lead to data leaks, unauthorized communications, or phishing attacks.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's principles of data protection and HIPAA's requirements for safeguarding protected health information. If an attacker injects unintended recipients into a mailto URI, sensitive data may be sent to unauthorized parties, resulting in compliance breaches and potential legal consequences.

Mitigation Strategies

Upgrade fast-uri to version 4.1.5 or later immediately. Use: npm update fast-uri or npm install fast-uri@latest. If upgrading is not possible, avoid processing mailto URIs that have been re-serialized without first decoding and re-validating the recipient, subject, and body fields.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86818. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart