link-preview-js vulnerable to IPv6 and internal loopback attacks

Description

The library did not check for IPv6 loopback attacks. There was also a DNS attack, where an address could be resolved into an internal IP. This could cause internal data leaks.

Recommendation

Update the link-preview-js package to the latest compatible version. Followings are version details:

• Affected version(s): <= 4.0.0
• Patched version(s): 4.0.1

References

• GHSA-4gp8-rjrq-ch6q
• CVE-2026-43897
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State - CVE-2026-42573
• Server-Side Request Forgery in link-preview-js - CVE-2022-25876
• orval MCP client is vulnerable to a code injection attack. - CVE-2026-22785
• path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters - CVE-2026-4867

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

link-preview-js