CVE-2026-86818
1 advisory.
npm/fast-uri CVE-2026-86818: medium 4.8
fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization
Action: Upgrade fast-uri to 4.1.5 or later.
npm i fast-uri@4.1.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.1.3 | 4.1.5 | - |
Fixed versions
| 4.1.5 |
Sources
- osv: GHSA-jvvf-x445-j334
- https://github.com/fastify/fast-uri/security/advisories/GHSA-jvvf-x445-j334
- https://nvd.nist.gov/vuln/detail/CVE-2026-86818
- https://github.com/fastify/fast-uri/commit/f40a88f33e684a46faec3f5b820bcbb1e85add64
- https://cna.openjsf.org/security-advisories.html
- https://github.com/fastify/fast-uri
- https://github.com/fastify/fast-uri/releases/tag/v4.1.5
CVE-2026-86818 · published · modified · JSON