Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address during the final connection. This DNS rebinding condition bypasses the SSRF protection and can cause the server-side preview fetch to reach internal HTTP resources. Redirect handling is affected by the same validation-to-fetch mismatch. This issue is fixed in version 4.0.4.

CVE-2026-61704 affects the Link Preview JS library (versions prior to 4.0.4), which is used to extract web link metadata. The vulnerability exists in the resolveDNSHost mitigation within index.ts, where the code validates one resolved IP address but subsequently fetches the original hostname. This mismatch creates a DNS rebinding condition that allows an attacker-controlled DNS server to return a public IP during validation and a loopback or internal IP during the actual fetch request. The flaw effectively bypasses the library's built-in SSRF (Server-Side Request Forgery) protection, potentially exposing internal HTTP resources. Redirect handling is also affected by the same validation-to-fetch mismatch. The issue has been patched in version 4.0.4, with fixes available via two separate commits on GitHub.