CVE-2026-61704: link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address during the final connection. This DNS rebinding condition bypasses the SSRF protection and can cause the server-side preview fetch to reach internal HTTP resources. Redirect handling is affected by the same validation-to-fetch mismatch. This issue is fixed in version 4.0.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Link Preview JSto a version that resolves this vulnerability.Fixed in 4.0.4
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Link Preview JS before version 4.0.4 are affected when they perform server-side preview fetching of attacker-supplied links. The resulting fetch can reach loopback or internal HTTP resources.
What does an attacker need to exploit this issue?
An attacker needs to provide a hostname controlled by a DNS server that can return a public IP address during validation and a loopback or internal IP address when the preview fetch connects. Redirects can also be used because redirect handling has the same validation-to-fetch mismatch.
How can I determine whether my application is affected?
Check the deployed Link Preview JS version. Versions prior to 4.0.4 contain the affected resolveDNSHost behavior; version 4.0.4 fixes the issue.
What should be done if the library cannot be upgraded immediately?
The provided information identifies version 4.0.4 as the fix. No temporary mitigation is specified.