{"action":"Upgrade link-preview-js to 4.0.4 or later.","affected":[{"fixed":"4.0.4","introduced":"0"}],"component":"link-preview-js","cve_ids":["CVE-2026-61704"],"ecosystem":"npm","epss":0.0055,"exploited":false,"fixed_versions":["4.0.4"],"ghsa_id":"GHSA-cpjf-6666-r8fx","id":"tcs_01M5KFK806E7C577ZMA6BTHKE1","modified_at":"2026-09-02T21:45:09.841015611Z","published_at":"2026-09-02T21:29:57Z","references":["https://osv.dev/vulnerability/GHSA-cpjf-6666-r8fx","https://github.com/OP-Engineering/link-preview-js/security/advisories/GHSA-cpjf-6666-r8fx","https://nvd.nist.gov/vuln/detail/CVE-2026-61704","https://github.com/OP-Engineering/link-preview-js/pull/181","https://github.com/OP-Engineering/link-preview-js/commit/6ee25043dd60b097eb70b4ce049aac94b28239e3","https://github.com/OP-Engineering/link-preview-js/commit/f3a3dd84adbb9d32d06a933f44ff3eaa837f9a12","https://github.com/OP-Engineering/link-preview-js","https://github.com/OP-Engineering/link-preview-js/releases/tag/4.0.4"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-cpjf-6666-r8fx","url":"https://osv.dev/vulnerability/GHSA-cpjf-6666-r8fx"}],"summary":"link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897"}