CVE-2026-61704
CVE-2026-61704 · link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address during the final connection. This DNS rebinding condition bypasses the SSRF protection and can cause the server-side preview fetch to reach internal HTTP resources. Redirect handling is affected by the same validation-to-fetch mismatch. This issue is fixed in version 4.0.4.
CVSS 7.5 · Hoch · EPSS 0,5% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: node
Betroffene Produkte und Versionen
link-preview-js
- Softwareversionen
- < 4.0.4: Betroffen
Keine Korrektur veröffentlicht
link-preview-js npm
- Betroffene Versionsbereiche
- SEMVER: < 4.0.4
Auf 4.0.4 aktualisieren
Originalquellen
- https://github.com/OP-Engineering/link-preview-js/security/advisories/GHSA-cpjf-6666-r8fx
- https://github.com/OP-Engineering/link-preview-js/pull/181
- https://github.com/OP-Engineering/link-preview-js/commit/6ee25043dd60b097eb70b4ce049aac94b28239e3
- https://github.com/OP-Engineering/link-preview-js/commit/f3a3dd84adbb9d32d06a933f44ff3eaa837f9a12
- https://github.com/OP-Engineering/link-preview-js/releases/tag/4.0.4
- https://nvd.nist.gov/vuln/detail/CVE-2026-61704