AIKIDO-2026-787444

TL;DR

fast-uri's mailto: parser compares a query field's raw, still-encoded name against the literal strings to, subject, and body, so a percent-encoded or differently-cased spelling of those names skips the comparison. Such a field is instead placed into the generic headers object under its decoded name, letting an encoded to/subject/body field reach code that trusts headers as ordinary data while carrying a real recipient or subject value. An application that inspects parsed.to/parsed.subject/parsed.body to filter a mailto: link, but forwards headers unfiltered, can have a hidden recipient smuggled past the filter. The fix decodes and lowercases field names before classifying and serializing them.