Skip to content
OpenAdvisories

Vendor

OP-Engineering

2 known vulnerabilities.

Products

link-preview-js 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-61704

    link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897

    Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validat…

    OP-Engineering link-preview-js link-preview-js npm
  • High 8.7
    CVE-2026-43897

    Link Preview JS: vunerable to IPv6 and internal loopback attacks

    Link Preview JS extracts web links information. Prior to 4.0.1, the library did not check for IPv6 loopback attacks. There was also a DNS attack, where an address could be resolved into an internal IP. This could cause internal data leaks. This vulnerability …

    OP-Engineering link-preview-js link-preview-js npm