Repository navigation
Security: OP-Engineering/link-preview-js
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
Report a vulnerability-
REGEX_VALID_URL is applied to the raw token while new URL() normalizes afterwards, so a hostname written with fullwidth digits reaches any private IPv4 address the filter is meant to blockGHSA-qv26-43gx-2qp2 published
Nov 4, 2026 by ospfrancoHigh -
Redirect-based SSRF in followRedirects:"follow" bypasses loopback/DNS-rebinding protection (incomplete redirect-scope fix for GHSA-cpjf-6666-r8fx)GHSA-pr9p-r5xm-659j published
Nov 4, 2026 by ospfrancoHigh -
link-preview-js resolveDNSHost SSRF bypass: followRedirects:'follow' follows 3xx to internal hosts without re-validationGHSA-x994-x7gh-x573 published
Nov 4, 2026 by ospfrancoCritical -
link-preview-js 4.0.3 DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897GHSA-cpjf-6666-r8fx published
Jun 23, 2026 by ospfrancoHigh -
<= 4.0.0 vunerable to IPv6 and internal loopback attacksGHSA-4gp8-rjrq-ch6q published
Apr 25, 2026 by ospfrancoHigh
Learn more about advisories related to OP-Engineering/link-preview-js in the GitHub Advisory Database