{"action":"Upgrade fast-uri to 4.1.5 or later.","affected":[{"fixed":"4.1.5","introduced":"4.1.3"}],"component":"fast-uri","cve_ids":["CVE-2026-86818"],"ecosystem":"npm","epss":0.00253,"exploited":false,"fixed_versions":["4.1.5"],"ghsa_id":"GHSA-jvvf-x445-j334","id":"tcs_01M5KFZ1SZWE6GRCP8BWGMR84Y","modified_at":"2026-09-30T00:00:03.854518772Z","published_at":"2026-09-29T23:51:16Z","references":["https://osv.dev/vulnerability/GHSA-jvvf-x445-j334","https://github.com/fastify/fast-uri/security/advisories/GHSA-jvvf-x445-j334","https://nvd.nist.gov/vuln/detail/CVE-2026-86818","https://github.com/fastify/fast-uri/commit/f40a88f33e684a46faec3f5b820bcbb1e85add64","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri","https://github.com/fastify/fast-uri/releases/tag/v4.1.5"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-jvvf-x445-j334","url":"https://osv.dev/vulnerability/GHSA-jvvf-x445-j334"}],"summary":"fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization"}