CVE-2026-61704

npm/link-preview-js CVE-2026-61704: high 7.5, EPSS 0.55%

link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897

Action: Upgrade link-preview-js to 4.0.4 or later.

npm i link-preview-js@4.0.4

Affected

Fixed versions

Sources

• osv: GHSA-cpjf-6666-r8fx
• https://github.com/OP-Engineering/link-preview-js/security/advisories/GHSA-cpjf-6666-r8fx
• https://nvd.nist.gov/vuln/detail/CVE-2026-61704
• https://github.com/OP-Engineering/link-preview-js/pull/181
• https://github.com/OP-Engineering/link-preview-js/commit/6ee25043dd60b097eb70b4ce049aac94b28239e3
• https://github.com/OP-Engineering/link-preview-js/commit/f3a3dd84adbb9d32d06a933f44ff3eaa837f9a12
• https://github.com/OP-Engineering/link-preview-js
• https://github.com/OP-Engineering/link-preview-js/releases/tag/4.0.4

CVE-2026-61704 · published 2026-09-02T21:29:57Z · modified 2026-09-02T21:45:09.841015611Z · JSON