Description
fast-uri’s mailto scheme parser compares each query field name to the reserved names (to, subject, body) while the name is still percent-encoded, and only percent-decodes it when storing it as a generic header.
Recommendation
Update the fast-uri package to the latest compatible version. Followings are version details:
- Affected version(s): >= 4.1.3, < 4.1.5
- Patched version(s): 4.1.5
References
Could your website be exposed too?
SmartScanner can check your website for fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization and gives you actionable findings to investigate.
Start a free scanRelated Issues
- fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding - CVE-2026-110306
- fast-uri vulnerable to host confusion via percent-encoded scheme normalization - CVE-2026-76172
- fast-uri vulnerable to path traversal via percent-encoded dot segments - CVE-2026-6321
- fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets - CVE-2026-86472
You might also like:
See something that needs correcting? Let us knowUpdated September 29, 2026