{"id":"EUVD-2026-29335","enisaUuid":"3d92fbda-fa46-345c-b07a-aeba79b25469","description":"Link Preview JS extracts web links information. Prior to 4.0.1, the library did not check for IPv6 loopback attacks. There was also a DNS attack, where an address could be resolved into an internal IP. This could cause internal data leaks. This vulnerability is fixed in 4.0.1.","datePublished":"May 11, 2026, 9:14:40 PM","dateUpdated":"May 12, 2026, 4:40:05 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/OP-Engineering/link-preview-js/security/advisories/GHSA-4gp8-rjrq-ch6q\nhttps://github.com/OP-Engineering/link-preview-js/pull/179\nhttps://github.com/OP-Engineering/link-preview-js/commit/4396d48909fab37553c0e93e26447fe218363ede\nhttps://github.com/OP-Engineering/link-preview-js/releases/tag/4.0.1\n","aliases":"CVE-2026-43897\nGHSA-4gp8-rjrq-ch6q\n","assigner":"GitHub_M","epss":0.65,"enisaIdProduct":[{"id":"78960327-0d22-3dc7-ad39-12c8c7f7cec6","product":{"name":"link-preview-js","vendor":{"name":"OP-Engineering"}},"product_version":"\u003c 4.0.1"}],"enisaIdVendor":[{"id":"2f146f5c-3323-36b7-bdaf-007ba65a1241","vendor":{"name":"OP-Engineering"}}],"enisaIdVulnerability":[{"id":"5989c772-57bd-316b-94d4-0d12812ebcb2","vulnerability":{"id":"GHSA-4gp8-rjrq-ch6q","description":"link-preview-js vulnerable to IPv6 and internal loopback attacks","datePublished":"May 5, 2026, 8:13:02 PM","dateUpdated":"May 13, 2026, 2:20:09 PM","baseScore":0.0,"references":"https://github.com/OP-Engineering/link-preview-js/security/advisories/GHSA-4gp8-rjrq-ch6q\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43897\nhttps://github.com/OP-Engineering/link-preview-js/pull/179\nhttps://github.com/OP-Engineering/link-preview-js/commit/4396d48909fab37553c0e93e26447fe218363ede\nhttps://github.com/OP-Engineering/link-preview-js\nhttps://github.com/OP-Engineering/link-preview-js/releases/tag/4.0.1\n","enisa_id":"EUVD-2026-29335\n","aliases":"CVE-2026-43897\nGHSA-4gp8-rjrq-ch6q\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"6f7be7b1-8940-3563-afbf-424d9a53d105","vulnerability":{"id":"CVE-2026-43897","description":"Link Preview JS extracts web links information. Prior to 4.0.1, the library did not check for IPv6 loopback attacks. There was also a DNS attack, where an address could be resolved into an internal IP. This could cause internal data leaks. This vulnerability is fixed in 4.0.1.","datePublished":"May 11, 2026, 9:14:40 PM","dateUpdated":"May 12, 2026, 4:40:05 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/OP-Engineering/link-preview-js/security/advisories/GHSA-4gp8-rjrq-ch6q\nhttps://github.com/OP-Engineering/link-preview-js/pull/179\nhttps://github.com/OP-Engineering/link-preview-js/commit/4396d48909fab37553c0e93e26447fe218363ede\nhttps://github.com/OP-Engineering/link-preview-js/releases/tag/4.0.1\n","enisa_id":"EUVD-2026-29335\n","assigner":"GitHub_M","epss":0.65,"dataProcessed":"Nov 3, 2026, 7:17:56 AM","vulnerabilityProduct":[{"id":"cb852636-4779-3590-9a24-d3ebcde821a3","product":{"name":"link-preview-js","vendor":{"name":"OP-Engineering"}},"product_version":"\u003c 4.0.1"}],"vulnerabilityVendor":[{"id":"dbc99d52-254e-3056-87c7-a03ad6f4bb4e","vendor":{"name":"OP-Engineering"}}]}}],"enisaIdAdvisory":[]}