CVE-2026-86818: 
Grafana vulnerability analysis and mitigation

CVE-2026-86818 is a mailto header injection vulnerability in the fast-uri Node.js library, caused by percent-encoded field-name desynchronization in its mailto scheme parser. It affects fast-uri versions 4.1.3 and 4.1.4 — the versions that introduced the mailto scheme parser — and was disclosed on September 15, 2026. The vulnerability allows an unauthenticated attacker to inject attacker-chosen email recipients and smuggle subject/body fields across a parse-serialize roundtrip without detection during initial validation. It carries a CVSS v3.1 base score of 4.8 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an encoding error (CWE-172) combined with an interpretation conflict (CWE-436) and inappropriate encoding for output context (CWE-838). The mailto parser in fast-uri 4.1.3–4.1.4 compares query field names against reserved names (to, subject, body) while the names are still percent-encoded, but only decodes them when storing as generic headers. As a result, a field name like %74o (percent-encoded to) is not recognized as a recipient at parse time — so parse().to shows only the legitimate recipient — but is re-emitted as the literal to= field after serialize(), causing a subsequent reparse to treat it as a recipient. The same technique can smuggle subject via %73ubject and body via %62ody. This parse-serialize desynchronization enables an attacker to craft a mailto URI that passes validation on first parse but gains additional recipients or modified fields after serialization (GitHub Advisory).

An unauthenticated attacker can craft a malicious mailto URI that, when processed by a vulnerable application, silently injects attacker-chosen email recipients and tampers with subject and body fields without being detected during initial validation, logging, or display. Applications that validate the recipient list on the initial parse and then re-serialize the URI before sending — such as those using fast-uri as a dependency via Fastify or ajv — are at risk of sending emails to unintended recipients with attacker-controlled content. The confidentiality and integrity impacts are low (partial), and there is no availability impact, but the deceptive nature of the bypass makes it particularly dangerous in email-sending workflows (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.0016 (0.16%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity, as the attacker must craft a specific percent-encoded mailto URI and the target application must follow the vulnerable parse-then-serialize pattern (GitHub Advisory).

1. Identify a vulnerable target: Find an application using fast-uri versions 4.1.3 or 4.1.4 (e.g., via Fastify or ajv dependencies) that accepts untrusted mailto URIs, validates recipients on initial parse, and then re-serializes the URI before sending email.
2. Craft a malicious mailto URI: Construct a mailto URI where the injected recipient field name is percent-encoded, e.g., mailto:legitimate@example.com?%74o=attacker@evil.com&subject=Hello — where %74o is the percent-encoding of to.
3. Submit the URI to the target application: Provide the crafted URI as input to the application (e.g., via a form field, API parameter, or link that the application processes).
4. Bypass validation: The application calls parse() on the URI; parse().to returns only legitimate@example.com because %74o is not recognized as the to field. Validation, logging, or display passes without detecting the injected recipient.
5. Trigger serialization: The application calls serialize() on the parsed result, which re-emits %74o as the literal to= field in the output string.
6. Achieve recipient injection: The serialized URI is passed to a mail client or outbound send path, which reparses it and treats the now-literal to=attacker@evil.com as a valid recipient, sending the email to the attacker-chosen address (GitHub Advisory).

• Application Logs: Mailto URIs in application logs containing percent-encoded field names such as %74o=, %73ubject=, or %62ody= in query strings, which may indicate crafted injection attempts.
• Email Logs: Outbound emails sent to unexpected recipients not present in the original validated recipient list; discrepancies between logged recipients (from initial parse) and actual email recipients (from serialized output).
• Network: Unusual outbound email traffic to domains not matching expected recipient domains, particularly following processing of user-supplied mailto URIs.
• Application Behavior: Applications processing mailto URIs that exhibit differences between parse().to output and the recipients in the final serialized URI string (GitHub Advisory).

Upgrade fast-uri to version 4.1.5 or later, which fixes the issue by correctly percent-decoding field names before comparing them to reserved names during parsing (GitHub Advisory). As a workaround for those unable to upgrade immediately, applications should not act on a mailto URI that fast-uri has re-serialized without first percent-decoding and re-validating the recipient, subject, and body fields. Alternatively, percent-decode and compare mailto field names case-insensitively before trusting parse().to, or re-check the recipient list on the serialized output rather than only on the initial parse (Red Hat Bugzilla).

The advisory was published by Matteo Collina (mcollina), a core maintainer of the Fastify project, with remediation review by Ulises Gascón (UlisesGascon), indicating prompt response from the fast-uri maintainer community (GitHub Advisory). Red Hat tracked the issue via their security response process (Bugzilla bug 2533688) with a medium severity rating, and Tenable added detection via Nessus plugin 345871 (Red Hat Bugzilla). No significant broader media coverage or notable social media discussion has been observed at this time.