CVE-2026-105645 — Ghost: Regular Expression Denial of Service in External Media Inliner
Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server …
Published: 2026-10-05 · CVSS: 4.9 · CVSS 3.1
Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7