Server-Side Request Forgery in link-preview-js

Description

The package link-preview-js before 2.1.17 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read the response. This is due to flawed DNS rebinding protection.

Recommendation

Update the link-preview-js package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.1.17
• Patched version(s): 2.1.17

References

• GHSA-h9cw-7g8j-h66h
• snyk.io
• CVE-2022-25876
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• Server-Side Request Forgery in @peertube/embed-api - CVE-2022-0508
• uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) - CVE-2022-0086
• uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) - uppy - CVE-2022-0086
• Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter - CVE-2025-68150

You might also like:

Exploiting Server Version Disclosure

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

link-preview-js