CVE-2026-86818

Name of the Vulnerable Software and Affected Versions fast-uri versions 4.1.3 through 4.1.4

Description The mailto parser compares query field names to reserved names such as to, subject, and body while they are still percent-encoded. Because the parser only decodes these names when storing them as generic headers, a percent-encoded version of a reserved field name is not recognized during the initial parse but is re-emitted as the literal field name during serialization. This desynchronization allows an attacker to smuggle a chosen recipient, subject, or body field across a roundtrip if an application validates the URI from the first parse and then serializes and sends it.

Recommendations Update fast-uri to version 4.1.5 or later. As a temporary workaround, do not act on a mailto URI that has been re-serialized without first decoding and re-validating the recipient, subject, and body fields.