PT-2026-37304 · Npm · Link-Preview-Js

Andrew-Most-Likely · Published 2026-05-05 · Updated 2026-05-11 · CVE-2026-43897

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Link Preview JS versions prior to 4.0.1

Description The library fails to check for IPv6 loopback attacks and is susceptible to DNS attacks where an address can be resolved into an internal IP. These issues may lead to internal data leaks.

Recommendations Update to version 4.0.1. Use the resolveDNSHost option to perform DNS resolution before fetching content. Perform manual validation before fetching content as a temporary workaround.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-43897

GHSA-4GP8-RJRQ-CH6Q

Affected Products

Link-Preview-Js

References · 9

• https://osv.dev/vulnerability/GHSA-4gp8-rjrq-ch6q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43897 · Security Note
• https://github.com/OP-Engineering/link-preview-js/security/advisories/GHSA-4gp8-rjrq-ch6q · Note
• https://github.com/OP-Engineering/link-preview-js/pull/179 · Note
• https://github.com/OP-Engineering/link-preview-js · Note
• https://github.com/OP-Engineering/link-preview-js/releases/tag/4.0.1 · Note
• https://github.com/OP-Engineering/link-preview-js/commit/4396d48909fab37553c0e93e26447fe218363ede · Note
• https://t.me/CVEtracker/53423 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2053987310866145330 · Twitter Post