CVE-2026-61704 is a high-severity vulnerability in Link Preview JS, a library used to extract web link information. The vulnerability, which has a CVSS score of 7.5, allows an attacker-controlled DNS server to bypass the SSRF protection and cause the server-side preview fetch to reach internal HTTP resources. This is achieved through a DNS rebinding condition, where the resolveDNSHost mitigation in index. [truncated]
CVE-2026-43897 is a high-severity vulnerability in Link Preview JS, a library used to extract web link information. Prior to version 4.0.1, the library was susceptible to IPv6 loopback attacks and DNS attacks that could resolve addresses into internal IPs, potentially causing internal data leaks. The vulnerability is fixed in version 4.0.1. Defenders should assess their exposure and update to version 4.0. [truncated]
