CVE-2026-86818 Overview
CVE-2026-86818 is an improper input decoding flaw [CWE-172] in fast-uri, a dependency-free RFC 3986 URI parser for Node.js used by Fastify and ajv. Versions 4.1.3 and 4.1.4 introduced a mailto scheme parser that compares each query field name to the reserved names to, subject, and body while the name is still percent-encoded. The parser decodes the name only when storing it as a generic header. This inconsistency lets attackers smuggle recipient, subject, and body values across a parse-then-serialize roundtrip.
Critical Impact
An application that validates a mailto URI's recipient list and later serializes the URI before sending can silently gain an attacker-chosen recipient, subject, or body.
Affected Products
- fast-uri version 4.1.3
- fast-uri version 4.1.4
- Downstream consumers including Fastify and ajv when using the mailto parser
Discovery Timeline
- 2026-09-15 - CVE-2026-86818 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-86818
Vulnerability Analysis
The flaw is a parser differential inside the mailto scheme handler added in fast-uri 4.1.3. When parsing the query string of a mailto: URI, the parser compares each field name against the reserved names to, subject, and body before percent-decoding it. A percent-encoded spelling such as %74o fails this comparison and is treated as a generic header. The same field is then percent-decoded when stored, and re-emitted as the literal field name during serialization.
This asymmetry breaks the assumption that parsing and serializing a URI produce equivalent semantic outputs. Any application that inspects the parsed representation to authorize or log the recipient list, then serializes the URI to hand off to a mail component, will act on a different set of fields than it validated. The primary impact is recipient smuggling, with secondary smuggling of the subject and body content.
Root Cause
The root cause is comparing encoded input to a decoded allow-list. The mailto parser should either percent-decode field names before the reserved-name comparison or normalize the URI once and use the same representation throughout the parse and serialize paths. Because decoding happens only in the storage branch, the reserved-name check and the serialized output disagree on which fields are recipients.
Attack Vector
An attacker supplies a crafted mailto: URI with percent-encoded reserved field names such as mailto:victim@example.com?%74o=attacker@example.com&%73ubject=smuggled. The first parse exposes only the original recipient to validation and logging code. When the application serializes the parsed URI and passes it to a mail sender, the smuggled to, subject, or body fields appear as literal reserved fields. Exploitation requires the target application to trust the post-parse view and to act on the serialized URI without re-validating it.
No verified public exploit code is available. See the GitHub Fastify Security Advisory for the maintainer's technical description.
Detection Methods for CVE-2026-86818
Indicators of Compromise
- Inbound mailto: URIs containing percent-encoded field names such as %74o, %73ubject, or %62ody in the query string.
- Log entries where the recipient list recorded at parse time differs from the recipients present in the outbound message.
- Outbound mail with additional recipients, subjects, or bodies not present in the originating request payload.
Detection Strategies
- Inventory Node.js services for fast-uri at versions 4.1.3 or 4.1.4 using npm ls fast-uri or software composition analysis tooling.
- Add unit tests that parse and re-serialize mailto URIs with percent-encoded reserved field names and assert field equivalence.
- Instrument mail-sending pathways to diff the validated recipient set against the final recipient set before transmission.
Monitoring Recommendations
- Alert on any mailto: URI where a query key matches the case-insensitive pattern %(74|54|73|53|62|42) followed by hex characters.
- Monitor mail gateway logs for messages whose To, Subject, or body fields were not present in the application's validation logs.
- Track dependency drift alerts for fast-uri and its transitive consumers such as fastify and ajv.
How to Mitigate CVE-2026-86818
Immediate Actions Required
- Upgrade fast-uri to version 4.1.5 or later in all Node.js services and rebuild dependent artifacts.
- Audit transitive dependencies with npm ls fast-uri to catch pinned older versions inside consumer packages.
- Reject or normalize any mailto: URI containing percent-encoded reserved field names before passing it to fast-uri.
Patch Information
The issue is fixed in fast-uri 4.1.5. The maintainers advise upgrading to 4.1.5 or later. Refer to the GitHub Fastify Security Advisory GHSA-jvvf-x445-j334 and the OpenJSF Security Advisories for the official fix notes.
Workarounds
- Do not act on a mailto URI that fast-uri has re-serialized without first decoding and re-validating its recipient, subject, and body fields.
- Percent-decode all query field names before performing any allow-list or authorization check against reserved mailto fields.
- Re-parse the serialized URI immediately before sending and compare the recipient list to the originally validated set.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.