CVE-2026-105646

Ghost: Regular Expression Denial of Service in Content Import

State: Published
Severity: 4.9 Medium
Published: Oct 5, 2026
Updated: Oct 7, 2026
Reserved: Oct 5, 2026

Description

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.

Scores

CVSS	Score	Vector	Source
3.1	4.9 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-1333 Inefficient Regular Expression Complexity

Affected Products

Product	Versions
GhostTryGhost	>= 4.0.0, < 6.67.0Affected

References

https://github.com/TryGhost/Ghost/security/advisories/GHSA-fwh9-qg68-vxp4
https://github.com/TryGhost/Ghost/pull/31058
https://github.com/TryGhost/Ghost/commit/88ae6d6d56f8a239cb38a8c89de02f034f50e2ce
https://github.com/TryGhost/Ghost/releases/tag/v6.66.0

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.