CVE-2026-86818

A flaw was found in fast-uri, a Node.js URI parser. In versions 4.1.3 and 4.1.4, the mailto parser incorrectly handles percent-encoded query field names. This desynchronization between parsing and serialization allows an attacker to inject arbitrary recipients, subjects, or body content into mailto URIs. An application that re-serializes a validated mailto URI could unknowingly send emails to unintended recipients or with manipulated content.

This Moderate vulnerability in fast-uri allows for mailto header injection due to a parsing discrepancy where percent-encoded field names are not correctly recognized as reserved fields until serialization. An attacker could exploit this in applications that parse and then re-serialize mailto URIs without re-validation, potentially leading to the smuggling of attacker-controlled recipient, subject, or body fields. This could result in unintended information disclosure or message manipulation within affected Red Hat products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.