HIGH SeverityCVSS 4.08.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVE-2026-43897

Last updated May 11, 2026 · Published May 11, 2026

Description

Link Preview JS extracts web links information. Prior to 4.0.1, the library did not check for IPv6 loopback attacks. There was also a DNS attack, where an address could be resolved into an internal IP. This could cause internal data leaks. This vulnerability is fixed in 4.0.1.

Affected products

1 listed

OP-Engineering:link-preview-js

Mappings

CWE

CWE-918

CAPEC

None listed.

Research

Server-Side Request Forgery (SSRF)Explains how untrusted URLs can make servers reach internal or cloud metadata endpoints. Covers validation,…

Guides

Next.js SSRF ProtectionCommon SSRF paths in Next.js and how to block them.

Training

SSRF and Request ForgeryWhen your server makes requests on behalf of an attacker.

CVE-2026-43897

Description

Affected products

Mappings

Related