CVE-2026-61704: link-preview-js DNS Rebinding SSRF Bypass - Incomplete Fix
Summary
CVE-2026-61704: link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897. Affects link-preview-js versions < 4.0.4. Fixed in 4.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
link-preview-js is a JavaScript library used for generating link previews by fetching metadata from URLs. It allows developers to easily integrate link previews into their applications. However, the library has been found to be vulnerable to a Server-Side Request Forgery (SSRF) attack, which can lead to unauthorized access to internal resources.
Vulnerability Detail
The vulnerability arises from an incomplete fix for a previously reported SSRF issue (CVE-2026-43897). The library validates a resolved IP address through the resolveDNSHost function but does not pin the connection to this validated IP during the fetch operation. This allows an attacker to exploit a controlled DNS server to return a public IP during validation and a loopback or internal IP during the actual connection, effectively bypassing the SSRF mitigation. The impact of this vulnerability is significant, as it can allow attackers to access sensitive internal resources under DNS rebinding conditions.
How To Fix
Latest published version: 5.0.1 as of 23 Oct 2026
npm install link-preview-js@5.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.4
This is the first release that contains the fix.
npm install link-preview-js@4.0.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned to mitigate this vulnerability other than updating to the patched version. Ensure that your application does not rely on the vulnerable version of link-preview-js.
Conclusion
The link-preview-js library has a significant vulnerability related to DNS rebinding SSRF bypass, which can be exploited to access internal resources. It is crucial to update to version 4.0.4 or later to mitigate this risk. Regular monitoring and vulnerability management practices should be implemented to safeguard applications.
See every vulnerability recorded for link-preview-js →
FAQ
The vulnerability is a DNS rebinding SSRF bypass that allows attackers to access internal resources by exploiting the library's handling of DNS resolution.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities. Visit Vulert Scanner to analyze your package-lock.json without any signup.
The potential impacts include unauthorized access to internal services and sensitive data, which could lead to further exploitation of the affected system.
Yes, the vulnerability is fixed in version 4.0.4 of link-preview-js. It is recommended to update to this version or later.
If you cannot update the package immediately, ensure that your application does not expose sensitive internal resources and monitor for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for link-preview-js.
