@kaikybrofc/zyra (0.2.4) potentially affected by CVE-2026-43897 +1 more via link-preview-js (4.0.3)

link-preview-js NPM version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on link-preview-js and may be impacted: - @kaikybrofc/zyra 0.2.4 Source cves: CVE-2026-43897, CVE-2026-61704 Source advisory: GHSA-CPJF-6666-R8FX...

link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897

The existing advisory GHSA-4gp8-rjrq-ch6q / CVE-2026-43897 states that the SSRF issue was fixed in 4.0.1. However, 4.0.3 remains bypassable when the documented resolveDNSHost mitigation is used. Root cause: The library validates one resolved IP address through resolveDNSHost, but later performs...

GHSA-CPJF-6666-R8FX link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897

The existing advisory GHSA-4gp8-rjrq-ch6q / CVE-2026-43897 states that the SSRF issue was fixed in 4.0.1. However, 4.0.3 remains bypassable when the documented resolveDNSHost mitigation is used. Root cause: The library validates one resolved IP address through resolveDNSHost, but later performs...

@aboutdisz/baileys (>=1.0.7, <=1.0.13), @aetherzcode/baileyszx (1.0.9) +147 more potentially affected by CVE-2026-43897 via link-preview-js (>=1.6.0, <=3.2.0)

link-preview-js NPM version =1.6.0, =1.0.7, =15.0.3, =1.0.0, =1.3.5, =1.0.5, =0.0.1, =2.0.5, =2.1.4, =3.0.0, =5.5.0 and more Source cves: CVE-2026-43897 Source advisory: MEND:CVE-2026-43897...