Description

Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address during the final connection. This DNS rebinding condition bypasses the SSRF protection and can cause the server-side preview fetch to reach internal HTTP resources. Redirect handling is affected by the same validation-to-fetch mismatch. This issue is fixed in version 4.0.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-20T17:18:51.940Z",
  "pubdate": "2026-08-20T17:18:51.940Z",
  "executiveSummary": "Link Preview JS prior to version 4.0.4 suffers from a Server-Side Request Forgery (SSRF) vulnerability caused by a Time-of-Check to Time-of-Use (TOCTOU) flaw during DNS resolution and subsequent HTTP fetching operations.\nThe vulnerability allows an attacker to bypass the built-in resolveDNSHost mitigation mechanism through a DNS rebinding attack.\nBy manipulating an attacker-controlled DNS server to return a safe public IP address during the initial validation check and switching to a loopback or internal network address during the final connection fetch, the application can be coerced into querying sensitive internal HTTP resources.\nThe issue similarly affects the redirect handling mechanism due to the same validation-to-fetch mismatch.\nSuccessful exploitation requires the attacker to control a malicious DNS server and trick the vulnerable component into generating a preview for a crafted domain name.\nThe risk implication involves unauthorized access to internal network infrastructure and services via the server-side preview generation feature.",
  "technicalDetails": "The vulnerability resides in the Link Preview JS package, specifically within index.ts and the resolveDNSHost mitigation function prior to version 4.0.4.\nThe root cause is a validation-to-fetch mismatch stemming from a classic Time-of-Check to Time-of-Use (TOCTOU) race condition inherent in asynchronous network operations where DNS resolution and HTTP connection requests are performed as separate, non-atomic steps.\nDuring the validation phase, the resolveDNSHost function correctly resolves the target hostname and inspects one resolved IP address to ensure it does not target restricted internal networks.\nHowever, instead of establishing the HTTP connection directly to the validated IP address, the component fetches the original hostname.\nThis design allows an attacker-controlled DNS server implementing a low Time-To-Live (TTL) configuration to alter the DNS response between the validation check and the actual connection attempt.\nThe attack flow proceeds as follows: First, the attacker provides a malicious URL to the Link Preview JS library. Second, the library queries the attacker-controlled DNS server, which returns a benign public IP address to successfully pass the resolveDNSHost validation check in index.ts. Third, upon validation success, the library initiates a network request using the original hostname. Fourth, the attacker-controlled DNS server responds with a loopback or internal IP address for the subsequent DNS query performed by the underlying HTTP client. Fifth, the server-side preview fetch bypasses SSRF protection controls and connects to internal HTTP resources.\nAdditionally, redirect handling logic is impacted by the exact same validation-to-fetch mismatch pattern, exposing further attack surface during HTTP redirection chains.\nThe vulnerability affects Link Preview JS versions prior to 4.0.4, requiring network exposure via the preview generation functionality without necessitating prior authentication or elevated privileges."
}