Description
The existing advisory GHSA-4gp8-rjrq-ch6q / CVE-2026-43897 states that the SSRF issue was fixed in 4.0.1. However, 4.0.3 remains bypassable when the documented resolveDNSHost mitigation is used.
Recommendation
Update the link-preview-js package to the latest compatible version. Followings are version details:
- Affected version(s): <= 4.0.3
- Patched version(s): 4.0.4
References
Could your website be exposed too?
SmartScanner can check your website for link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897 and gives you actionable findings to investigate.
Start a free scanRelated Issues
- link-preview-js vulnerable to IPv6 and internal loopback attacks - CVE-2026-43897
- Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4) - CVE-2026-41321
- nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect) - CVE-2026-44589
- Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
You might also like:
See something that needs correcting? Let us knowUpdated September 02, 2026