EUVD-2026-63439
GHSA-cpjf-6666-r8fx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H reflects the DNS rebinding prerequisite of attacker-controlled DNS infrastructure and timing within the TTL window; no authentication required and confidentiality impact is high.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4Blast Radius
ecosystem impact- 9 npm packages depend on link-preview-js (9 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.0.4.
DescriptionCVE.org
Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address during the final connection. This DNS rebinding condition bypasses the SSRF protection and can cause the server-side preview fetch to reach internal HTTP resources. Redirect handling is affected by the same validation-to-fetch mismatch. This issue is fixed in version 4.0.4.
AnalysisAI
DNS rebinding in link-preview-js prior to 4.0.4 allows unauthenticated remote attackers to bypass the library's built-in SSRF protections and reach internal HTTP resources from the server hosting the preview service. The resolveDNSHost callback resolves a hostname once for validation but passes the original hostname back to the fetch layer, creating a time-of-check/time-of-use window that an attacker-controlled DNS server can exploit by returning a legitimate public IP during validation and an internal or loopback address on subsequent resolution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability requires that: (1) the target application runs link-preview-js in a server-side Node.js context with a version prior to 4.0.4; (2) the application accepts user-supplied URLs and passes them to getLinkPreview() using the resolveDNSHost callback as its SSRF mitigation; and (3) the attacker controls a DNS server authoritative for a domain they own, capable of returning different IP addresses across successive resolution queries within a short TTL window. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) rates attack complexity as Low, which overstates ease of exploitation: successful DNS rebinding requires the attacker to operate a DNS server authoritative for a domain they control, configure very short TTLs, and time the race between the library's validation and fetch phases. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade link-preview-js to version 4.0.4, which resolves the DNS rebinding bypass by fetching the validated resolved IP address directly rather than re-resolving the original hostname (see https://github.com/OP-Engineering/link-preview-js/releases/tag/4.0.4 and patch commits 6ee25043 and f3a3dd84 referenced in GHSA-cpjf-6666-r8fx). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications and systems using link-preview-js and identify instances running versions below 4.0.4; flag internet-facing URL preview services as highest priority. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Link Preview Js
View allSame weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today