CVE-2026-86818

A flaw was found in fast-uri, a Node.js URI parser. In versions 4.1.3 and 4.1.4, the mailto parser incorrectly handles percent-encoded query field names. This desynchronization between parsing and serialization allows an attacker to inject arbitrary recipients, subjects, or body content into mail...

CVE-2026-86472

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decod...

CVE-2026-86818

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still...

DEBIAN-CVE-2026-86472

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decod...

DEBIAN-CVE-2026-86818

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still...

CVE-2026-86472

A flaw was found in fast-uri, a dependency-free URI parser. This vulnerability occurs because the software folds the host to lowercase before percent-decoding it, allowing percent-encoded uppercase characters to bypass this normalization. A remote attacker could exploit this by crafting a malicio...

CVE-2026-86818 fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still...

CVE-2026-86818 fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still...

CVE-2026-86818

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still...

CVE-2026-86818

fast-uri v4.1.3–4.1.4, a dependency-free RFC 3986 URI parser for Node.js used by Fastify and ajv , suffers from a percent-encoded field-name desynchronization in its mailto parser. At parse time, reserved field names (to, subject, body) are compared in their still-percent-encoded form and thus no...

CVE-2026-86818 fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still...

Inappropriate Encoding for Output Context

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Inappropriate Encoding for Output Context in the mailto parser when handling percent-encoded query field names. An attacker can manipulate email recipients, subjects, or body content by...

CVE-2026-86818

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still...

CVE-2026-86472 fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decod...

Improper Handling of Case Sensitivity

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity due to inconsistent normalization in the host component. An attacker can gain unauthorized access to restricted resources or services by submitting...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @diviops/mcp-server (>=1.5.40, <=1.5.55) +37 more potentially affected by CVE-2026-86472 via fast-uri (>=3.0.1, <=3.1.7)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.6.0, =1.4.2, =1.2.0, =0.17.1, =2.7.9, =5.4.3, =0.2.0-alpha.5, =0.2.0-alpha.12 and more Source cves: CVE-2026-86472 Source advisory: MEND:CVE-2026-86472...

CVE-2026-86472 fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decod...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @diviops/mcp-server (>=1.5.40, <=1.5.55) +37 more potentially affected by CVE-2026-86472 via fast-uri (>=3.0.1, <=3.1.7)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.6.0, =1.4.2, =1.2.0, =0.17.1, =2.7.9, =5.4.3, =0.2.0-alpha.5, =0.2.0-alpha.12 and more Source cves: CVE-2026-86472 Source advisory: SNYK:JS-FASTURI-19846649...

@datastream/validate (>=0.0.4, <=0.0.38), @dearmrzhang/customs-mcp-server (>=0.1.2, <=1.1.0) +15 more potentially affected by CVE-2026-86472 via fast-uri (>=2.1.0, <=2.3.0)

fast-uri NPM version =2.1.0, =0.0.4, =0.1.2, =0.0.1, =0.0.1, =3.1.0-rc.0, =0.2.0, =0.2.0, =0.2.0, =0.0.1, =0.0.0, =1.0.0, =3.0.0, =1.7.0, =1.8.0 and more Source cves: CVE-2026-86472 Source advisory: SNYK:JS-FASTURI-19846649...

@datastream/validate (>=0.0.4, <=0.0.38), @dearmrzhang/customs-mcp-server (>=0.1.2, <=1.1.0) +37 more potentially affected by CVE-2026-86472 via fast-uri (>=1.0.1, <=2.3.0)

fast-uri NPM version =1.0.1, =0.0.4, =0.1.2, =0.0.1, =0.0.1, =1.0.0, =0.19.0-alpha.1682329905.32209c5e, =0.19.0-alpha.1681870131.da1d707d, =0.19.0-alpha.1681870131.da1d707d, =1.0.0, =1.0.2, =2.0.0, =2.0.0, =3.1.0-rc.0, =5.4.2 and more Source cves: CVE-2026-86472 Source advisory: MEND:CVE-2026-864...