CVE-2026-43897 Details
Description
Link Preview JS extracts web links information. Prior to 4.0.1, the library did not check for IPv6 loopback attacks. There was also a DNS attack, where an address could be resolved into an internal IP. This could cause internal data leaks. This vulnerability is fixed in 4.0.1.
A vulnerability in Link Preview JS prior to version 4.0.1 allowed for IPv6 loopback attacks and internal data leaks via DNS resolution of addresses into internal IPs. The library did not properly validate IPv6 loopback addresses, which could be exploited to access internal data. Additionally, the lack of proper DNS resolution could lead to similar leaks by resolving external addresses into internal ones.
Users should update to Link Preview JS version 4.0.1 or later and ensure that the 'resolveDNSHost' option is enabled to properly validate and resolve DNS addresses before fetching content. The latest version can be downloaded from the GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 11, 2026CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OP-Engineering/link-preview-js/commit/4396d48909fab37553c0e93e26447fe218363ede | [email protected] | Source CodeVendor |
| https://github.com/OP-Engineering/link-preview-js/pull/179 | [email protected] | Issue TrackingVendor |
| https://github.com/OP-Engineering/link-preview-js/releases/tag/4.0.1 | [email protected] | Release NotesVendor |
| https://github.com/OP-Engineering/link-preview-js/security/advisories/GHSA-4gp8-rjrq-ch6q | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OP-Engineering link-preview-js | <= 4.0.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | New CVE Received | [email protected] |