Skip to content
OpenAdvisories

Package · npm

link-preview-js

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.5
    CVE-2026-61704

    link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897

    Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validat…

    OP-Engineering link-preview-js link-preview-js npm
  • High 8.7
    CVE-2026-43897

    Link Preview JS: vunerable to IPv6 and internal loopback attacks

    Link Preview JS extracts web links information. Prior to 4.0.1, the library did not check for IPv6 loopback attacks. There was also a DNS attack, where an address could be resolved into an internal IP. This could cause internal data leaks. This vulnerability …

    OP-Engineering link-preview-js link-preview-js npm
  • Medium 6.2
    CVE-2022-25876

    Server-side Request Forgery (SSRF)

    The package link-preview-js before 2.1.16 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read the response. This is due to flawed DNS rebinding protection.

    link-preview-js npm