link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897

The existing advisory GHSA-4gp8-rjrq-ch6q / CVE-2026-43897 states that the SSRF issue was fixed in 4.0.1. However, 4.0.3 remains bypassable when the documented resolveDNSHost mitigation is used. Root cause: The library validates one resolved IP address through resolveDNSHost, but later performs...

GHSA-CPJF-6666-R8FX link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897

The existing advisory GHSA-4gp8-rjrq-ch6q / CVE-2026-43897 states that the SSRF issue was fixed in 4.0.1. However, 4.0.3 remains bypassable when the documented resolveDNSHost mitigation is used. Root cause: The library validates one resolved IP address through resolveDNSHost, but later performs...