{"id":"EUVD-2026-63439","enisaUuid":"2277b667-2366-38e2-a9de-8fcc1b0d16da","description":"Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address during the final connection. This DNS rebinding condition bypasses the SSRF protection and can cause the server-side preview fetch to reach internal HTTP resources. Redirect handling is affected by the same validation-to-fetch mismatch. This issue is fixed in version 4.0.4.","datePublished":"Aug 20, 2026, 4:21:10 PM","dateUpdated":"Aug 25, 2026, 3:03:17 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/OP-Engineering/link-preview-js/security/advisories/GHSA-cpjf-6666-r8fx\nhttps://github.com/OP-Engineering/link-preview-js/pull/181\nhttps://github.com/OP-Engineering/link-preview-js/commit/6ee25043dd60b097eb70b4ce049aac94b28239e3\nhttps://github.com/OP-Engineering/link-preview-js/commit/f3a3dd84adbb9d32d06a933f44ff3eaa837f9a12\nhttps://github.com/OP-Engineering/link-preview-js/releases/tag/4.0.4\n","aliases":"CVE-2026-61704\nGHSA-cpjf-6666-r8fx\n","assigner":"GitHub_M","epss":0.55,"enisaIdProduct":[{"id":"aa0ca77f-ca48-36d9-bdf6-9a39a9bf4c67","product":{"name":"link-preview-js","vendor":{"name":"OP-Engineering"}},"product_version":"\u003c 4.0.4"}],"enisaIdVendor":[{"id":"17a318e6-f715-3f08-965d-6fe064d40cc9","vendor":{"name":"OP-Engineering"}}],"enisaIdVulnerability":[{"id":"9fc7a0a7-9e8a-358d-8a77-7f80ad1e07f3","vulnerability":{"id":"CVE-2026-61704","description":"Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address during the final connection. This DNS rebinding condition bypasses the SSRF protection and can cause the server-side preview fetch to reach internal HTTP resources. Redirect handling is affected by the same validation-to-fetch mismatch. This issue is fixed in version 4.0.4.","datePublished":"Aug 20, 2026, 4:21:10 PM","dateUpdated":"Aug 25, 2026, 3:03:17 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/OP-Engineering/link-preview-js/security/advisories/GHSA-cpjf-6666-r8fx\nhttps://github.com/OP-Engineering/link-preview-js/pull/181\nhttps://github.com/OP-Engineering/link-preview-js/commit/6ee25043dd60b097eb70b4ce049aac94b28239e3\nhttps://github.com/OP-Engineering/link-preview-js/commit/f3a3dd84adbb9d32d06a933f44ff3eaa837f9a12\nhttps://github.com/OP-Engineering/link-preview-js/releases/tag/4.0.4\n","enisa_id":"EUVD-2026-63439\n","assigner":"GitHub_M","epss":0.55,"dataProcessed":"Nov 5, 2026, 7:15:07 AM","vulnerabilityProduct":[{"id":"c9905722-ebbd-3b54-99fb-4dc919dd1b3a","product":{"name":"link-preview-js","vendor":{"name":"OP-Engineering"}},"product_version":"\u003c 4.0.4"}],"vulnerabilityVendor":[{"id":"2d129982-8ea2-3847-a76b-fa698e14763d","vendor":{"name":"OP-Engineering"}}]}},{"id":"b3a88a03-ee4c-3a60-b615-5e0094f5b1a5","vulnerability":{"id":"GHSA-cpjf-6666-r8fx","description":"link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897","datePublished":"Sep 2, 2026, 9:29:57 PM","dateUpdated":"Sep 2, 2026, 9:29:57 PM","baseScore":0.0,"references":"https://github.com/OP-Engineering/link-preview-js/security/advisories/GHSA-cpjf-6666-r8fx\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-61704\nhttps://github.com/OP-Engineering/link-preview-js/pull/181\nhttps://github.com/OP-Engineering/link-preview-js/commit/6ee25043dd60b097eb70b4ce049aac94b28239e3\nhttps://github.com/OP-Engineering/link-preview-js/commit/f3a3dd84adbb9d32d06a933f44ff3eaa837f9a12\nhttps://github.com/OP-Engineering/link-preview-js\nhttps://github.com/OP-Engineering/link-preview-js/releases/tag/4.0.4\n","enisa_id":"EUVD-2026-63439\n","aliases":"CVE-2026-61704\nGHSA-cpjf-6666-r8fx\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}