Vulnerability in fast-uri Library for Node.js Affecting Fastify and ajv
CVE-2026-86818

4.8MEDIUM

Key Information:

Vendor

Fast-uri

Status
Fast-uri
Vendor
CVE Published:
15 September 2026

What is CVE-2026-86818?

The fast-uri library, a parsing tool for URIs used in Node.js applications like Fastify and ajv, contains a flaw in its mailto scheme parser introduced in versions 4.1.3 and 4.1.4. This vulnerability arises because the library does not recognize percent-encoded reserved field names during parsing. As a result, if an application validates or logs recipients from the parsed URI without treating percent-encoded names correctly, it may inadvertently allow malicious actors to manipulate the recipient list, and smuggle subject and body content across requests. Users are urged to upgrade to fast-uri version 4.1.5 or later to mitigate this issue. A temporary workaround involves ensuring that mailto URIs are decoded and validated before use.

Affected Version(s)

fast-uri 4.1.3 < 4.1.5

fast-uri 4.1.5

References

https://github.com/fastify/fast-uri/security/advisories/G...
https://cna.openjsf.org/security-advisories.html

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
mcollina
UlisesGascon
manus-pi
.