OP-Engineering vulnerabilities
We track 2 vulnerabilities in OP-Engineering products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 20, 2026.
2vulnerabilities
0critical
2high
0exploited
8.1average CVSS score
Latest OP-Engineering vulnerabilities
- 7.5 High severity
link-preview-js: Server-Side Request Forgery
Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validati
- 8.7 High severity
link-preview-js: Server-Side Request Forgery
Link Preview JS extracts web links information. Prior to 4.0.1, the library did not check for IPv6 loopback attacks. There was also a DNS attack, where an address could be resolved into an internal IP. This could cause internal data leaks. This vulnerability i