CVE-2026-43897

High

Published: 11/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Link Preview JS prior to version 4.0.1 did not check for IPv6 loopback attacks and DNS attacks, which could lead to internal data leaks.

Risk Assessment

Organizations may be exposed to internal data leaks, potentially resulting in the loss of sensitive information.

Recommendation

It is recommended to update the Link Preview JS library to version 4.0.1 or later to mitigate these vulnerabilities.

Other vulnerabilities in Link Preview JS

CVE-2026-61704High
Link Preview JS prior to 4.0.4 has a vulnerability in the resolveDNSHost mitigation that validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address during the final connection, bypassing SSRF protection.

Original NVD description (English source)

Link Preview JS extracts web links information. Prior to 4.0.1, the library did not check for IPv6 loopback attacks. There was also a DNS attack, where an address could be resolved into an internal IP. This could cause internal data leaks. This vulnerability is fixed in 4.0.1.