CVE-2026-61704 json
link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
published 2026-08-20 2 mo ago modified 2026-10-18 21 d ago also GHSA-cpjf-6666-r8fx , EUVD-2026-63439
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 46%
- public exploits
- 0
- none known
Summary
Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address during the final connection. This DNS rebinding condition bypasses the SSRF protection and can cause the server-side preview fetch to reach internal HTTP resources. Redirect handling is affected by the same validation-to-fetch mismatch. This issue is fixed in version 4.0.4.
Patch / fix
- npm link-preview-js 4.0.4
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | link-preview-js | <4.0.4 |
4.0.4 |
Affected products
- OP-Engineering link-preview-js
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/OP-Engineering/link-preview-js/pull/181
web
-
github.com
/OP-Engineering/link-preview-js/commit/6ee25043dd60b097eb70b4ce049aac94b28239e3
web
-
github.com
/OP-Engineering/link-preview-js/commit/f3a3dd84adbb9d32d06a933f44ff3eaa837f9a12
web
-
github.com
/OP-Engineering/link-preview-js/security/advisories/GHSA-cpjf-6666-r8fx
web
-
github.com
/OP-Engineering/link-preview-js/releases/tag/4.0.4
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-61704
advisory
-
github.com
/OP-Engineering/link-preview-js
package
Sources
- CVE List CVE-2026-61704
- GitHub Advisory GHSA-cpjf-6666-r8fx
- NVD CVE-2026-61704
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.