CVE-2026-61704

HighCVSS 7.5

Published: 20/08/2026(UTC)Updated: 25/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

33th percentile - higher than 33% of all known CVEs

Summary

Link Preview JS prior to 4.0.4 has a vulnerability in the resolveDNSHost mitigation that validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address during the final connection, bypassing SSRF protection.

Risk Assessment

An attacker could use DNS rebinding to access internal network resources, potentially leading to data disclosure or security compromise.

Recommendation

Update Link Preview JS to version 4.0.4 or later. Strengthen DNS validation and consider blocking internal addresses.

Other vulnerabilities in Link Preview JS

CVE-2026-43897High
Link Preview JS prior to version 4.0.1 did not check for IPv6 loopback attacks and DNS attacks, which could lead to internal data leaks.

Original NVD description (English source)

Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address during the final connection. This DNS rebinding condition bypasses the SSRF protection and can cause the server-side preview fetch to reach internal HTTP resources. Redirect handling is affected by the same validation-to-fetch mismatch. This issue is fixed in version 4.0.4.