CVE-2026-43897: link-preview-js Vulnerable to IPv6 and Internal Loopback Attacks
Summary
CVE-2026-43897: link-preview-js vulnerable to IPv6 and internal loopback attacks. Affects link-preview-js versions < 4.0.1. Fixed in 4.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
link-preview-js is a JavaScript library designed to generate link previews for URLs. It allows developers to easily fetch and display metadata from web pages, enhancing user experience by providing rich content previews. However, the library has been found to be vulnerable to specific attacks that could lead to internal data leaks, particularly through IPv6 and DNS resolution issues.
Vulnerability Detail
The vulnerability arises from the library's failure to adequately check for IPv6 loopback attacks and its susceptibility to DNS attacks. An attacker could exploit this by resolving a domain name to an internal IP address, potentially leaking sensitive internal data. The regex validation for IPv6 addresses was insufficient, allowing for these types of attacks to occur.
How To Fix
Latest published version: 5.0.1 as of 23 Oct 2026
npm install link-preview-js@5.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.1
This is the first release that contains the fix.
npm install link-preview-js@4.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can implement their own validation checks before fetching content. This could involve manually verifying the URLs against a list of allowed domains or implementing stricter regex checks for IPv6 addresses.
Conclusion
The vulnerability identified as CVE-2026-43897 in the link-preview-js library poses significant risks due to its susceptibility to IPv6 and DNS attacks. Users are strongly advised to update to version 4.0.1 or later and implement additional validation measures to protect against potential data leaks.
See every vulnerability recorded for link-preview-js →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
This vulnerability allows for IPv6 loopback attacks and DNS resolution attacks, which can lead to internal data leaks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update to the patched version, it is crucial to implement your own validation checks before fetching content to mitigate the risk.
More information about link-preview-js can be found on its official GitHub repository or documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for link-preview-js.
