Threats affecting pkg:npm/link-preview-js

CVE-2026-61704 is a Server-Side Request Forgery (SSRF) vulnerability in the OP-Engineering link-preview-js library prior to version 4.0.4. The issue arises from a DNS rebinding attack where the mitigation logic validates a resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to bypass SSRF protections. This can lead to unauthorized server-side requests to internal HTTP resources. The vulnerability also affects redirect handling due to the same validation-to-fetch mismatch. The issue is fixed in version 4.0.4.

CVE-2026-43897 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in the OP-Engineering link-preview-js library versions prior to 4.0.1. The vulnerability arises because the library did not properly validate IPv6 loopback addresses and was susceptible to DNS attacks that could resolve addresses to internal IPs. This flaw could lead to internal data leaks by allowing unauthorized access to internal network resources. The issue is fixed in version 4.0.1 of the library.