CVE-2026-43897 Link Preview JS: vunerable to IPv6 and internal loopback attacks
An attacker can exploit Server-Side Request Forgery to access internal network resources and leak sensitive data via IPv6 or DNS rebinding attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43897?
CVE-2026-43897 is a high-severity server-side request forgery vulnerability in OP-Engineering link-preview-js, published on 11 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Link Preview JS extracts web links information. Prior to 4.0.1, the library did not check for IPv6 loopback attacks. There was also a DNS attack, where an address could be resolved into an internal IP. This could cause internal data leaks. This vulnerability is fixed in 4.0.1.
Weakness: CWE-918
Which versions are affected by CVE-2026-43897?
2 open source packages ship an affected version, including link-preview-js.
| Package | Affected | Fixed in |
|---|---|---|
link-preview-js npm | All versions | 4.0.1 |
link-preview-js npm | All versions | 4.0.1 |
How do I fix CVE-2026-43897?
Upgrade link-preview-js to 4.0.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-43897 being exploited?
There is no known exploitation of CVE-2026-43897 in the wild and no public exploit code.
Sources
Also known as GHSA-4gp8-rjrq-ch6q.