link-preview-js vulnerabilities
2 known vulnerabilities in link-preview-js from OP-Engineering. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
2vulnerabilities
0critical
2high
0exploited
8.1average CVSS score
Latest first
- 7.5 High severity
link-preview-js: Server-Side Request Forgery
Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validati
- 8.7 High severity
link-preview-js: Server-Side Request Forgery
Link Preview JS extracts web links information. Prior to 4.0.1, the library did not check for IPv6 loopback attacks. There was also a DNS attack, where an address could be resolved into an internal IP. This could cause internal data leaks. This vulnerability i