Description
The library did not check for IPv6 loopback attacks. There was also a DNS attack, where an address could be resolved into an internal IP. This could cause internal data leaks.
Recommendation
Update the link-preview-js package to the latest compatible version. Followings are version details:
- Affected version(s): <= 4.0.0
- Patched version(s): 4.0.1
References
Could your website be exposed too?
SmartScanner can check your website for link-preview-js vulnerable to IPv6 and internal loopback attacks and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State - CVE-2026-42573
- Server-Side Request Forgery in link-preview-js - CVE-2022-25876
- orval MCP client is vulnerable to a code injection attack. - CVE-2026-22785
- path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters - CVE-2026-4867
You might also like:
See something that needs correcting? Let us knowUpdated May 13, 2026