CVE-2026-61704: link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
The existing advisory GHSA-4gp8-rjrq-ch6q / CVE-2026-43897 states that the SSRF issue was fixed in 4.0.1. However, 4.0.3 remains bypassable when the documented resolveDNSHost mitigation is used.
Root cause: The library validates one resolved IP address through resolveDNSHost, but later performs fetch() against the original hostname without pinning the connection to the validated IP. An attacker-controlled DNS server can return a public IP during validation and a loopback/internal IP during the final connection.
Impact: This allows an attacker to bypass the documented SSRF mitigation and make the server-side fetch reach loopback or internal addresses under DNS rebinding conditions.
This appears to be either an incomplete fix for CVE-2026-43897 or a new DNS rebinding SSRF bypass affecting the latest version.
The PoC was reproduced in a local-only controlled environment to avoid targeting production or third-party systems. Evidence and reproduction details can be provided privately.
References
- github.com/OP-Engineering/link-preview-js/commit/6ee25043dd60b097eb70b4ce049aac94b28239e3
- github.com/OP-Engineering/link-preview-js/commit/f3a3dd84adbb9d32d06a933f44ff3eaa837f9a12
- github.com/OP-Engineering/link-preview-js/pull/181
- github.com/OP-Engineering/link-preview-js/releases/tag/4.0.4
- github.com/OP-Engineering/link-preview-js/security/advisories/GHSA-cpjf-6666-r8fx
- github.com/advisories/GHSA-cpjf-6666-r8fx
- nvd.nist.gov/vuln/detail/CVE-2026-61704
Code Behaviors & Features
Detect and mitigate CVE-2026-61704 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →