The vulnerability in link‑preview‑js permits a DNS rebinding attack that bypasses the library’s SSRF protection. During host validation the code checks one resolved IP address but later performs a fetch against the original hostname. An attacker can provide a DNS record that resolves to a public IP for validation and then to a loopback or internal address for the subsequent request, causing the server to reach internal HTTP resources. This flaw can lead to unauthorized access to internal services and potential lateral movement.

The issue affects all versions of the OP‑Engineering link‑preview‑js package prior to 4.0.4. Any deployment of these earlier releases is vulnerable. Upgrading to 4.0.4 or later resolves the validation‑to‑fetch mismatch.

The CVSS score of 7.5 indicates high severity. EPSS data are currently unavailable, so the exact likelihood of exploitation cannot be quantified, but the vulnerability is not listed in the CISA KEV catalog. Attackers would need to control a DNS server for a hostname that the application resolves, then use DNS rebinding to redirect the internal request to an internal address. If successful, the attacker can extract or influence data on internal networks via SSRF.