CVE-2026-105646 — Ghost: Regular Expression Denial of Service in Content Import
Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Explo…
Published: 2026-10-05 · CVSS: 4.9 · CVSS 3.1
Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7