This is due to link-preview-js 4.0.4 module bug (reported at https://github.com/OP-Engineering/link-preview-js/issues/182)

For proper fix, NodeBB need to embed 5.x which fix this issue

For immediate fix, modify /usr/src/app/node_modules/link-preview-js/build/index.js

Replace

    const parsedUrl = new URL(url);
    parsedUrl.hostname = formatHostnameForUrl(resolvedAddress);
    return parsedUrl.href;

with

return url;

This will return to 4.0.3 approach

Potential risk (by AI):
an attacker who controls DNS for a domain they post returns a public IP to resolveDNSHost (passes throwOnLoopback), then returns an internal IP milliseconds later when fetch re-resolves. The fetched internal service's HTML/text would render into a preview card → SSRF data-exfiltration channel.

Risk is low:

• Requires authenticated posting + a reliable rebinding race (hard to time) — not a trivial drive-by.
• Cloud metadata (169.254.169.254) and all RFC-1918 ranges are still blocked on the first resolution. The exposure is the second resolution only.

See Here: https://community.nodebb.org/topic/17384/nodebb-plugin-link-preview-rich-embeds-and-link-previews/71