DNS Rebinding Vulnerability in Link Preview JS by OP Engineering
CVE-2026-61704

7.5HIGH

Key Information:

Vendor

Op-engineering

Status
Link-preview-js
Vendor
CVE Published:
20 August 2026

What is CVE-2026-61704?

Link Preview JS prior to version 4.0.4 contains a vulnerability related to DNS rebinding through the resolveDNSHost function. This flaw allows an attacker-controlled DNS server to send a public IP address during the validation process, while later redirecting to a loopback or internal IP address during actual connection attempts. This bypasses the server-side request forgery (SSRF) protections, enabling unauthorized access to internal HTTP resources. The issue has been addressed in version 4.0.4, mitigating the risk of such exploits.

Affected Version(s)

link-preview-js < 4.0.4

References

https://github.com/OP-Engineering/link-preview-js/securit...
x_refsource_CONFIRM
https://github.com/OP-Engineering/link-preview-js/pull/181
x_refsource_MISC
https://github.com/OP-Engineering/link-preview-js/commit/...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.