TI-2026-67871 Aliases CVE-2026-105646 GHSA-fwh9-qg68-vxp4

Regular expression denial of service in Ghost content import

LOW 22CWE-1333Published 2026-10-05 · Updated 2026-10-07

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1333.

Summary

Ghost, a Node.js content management system, is affected from 4.0.0 before 6.67.0. A crafted content import file triggers inefficient regular expression processing (CWE-1333), which causes excessive CPU usage and makes the Ghost server unresponsive. Exploiting this requires Administrator access.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00346 28th percentileScored 2026-11-07

Fix Fixed Ghost (TryGhost): 6.67.0ghost (npm): 6.67.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TryGhost	Ghost	4.0.0 to before 6.67.0	6.67.0	Patch available	CNA
—	ghost (npm)	4.0.0 to before 6.67.0	6.67.0	Patch available	GHSA-fwh9-qg68-vxp4

Ghost VendorTryGhost Affected 4.0.0 to before 6.67.0 Fixed in 6.67.0 Patch available CNA
ghost (npm) Vendor— Affected 4.0.0 to before 6.67.0 Fixed in 6.67.0 Patch available GHSA-fwh9-qg68-vxp4

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:ghost:ghost::::::::	—	—	TryGhost

cpe:2.3:a:ghost:ghost:*:*:*:*:*:*:*:* Versions — — ·TryGhost

Remediation

Upgrade the Ghost npm package (ghost) to version 6.67.0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA Ghost (TryGhost) Fixed in 6.67.0
Fix · GHSA-fwh9-qg68-vxp4 ghost (npm) Fixed in 6.67.0 Advisory →

Timeline

2026-10-05 Threatist record created from CVE-2026-105646
2026-10-07 Alias added: GHSA-fwh9-qg68-vxp4
2026-10-07 Fix available: npm/[email protected] · GHSA-fwh9-qg68-vxp4
2026-10-07 CVSS score added · GHSA-fwh9-qg68-vxp4
2026-10-07 Weakness changed · GHSA-fwh9-qg68-vxp4
2026-10-07 6 new references · GHSA-fwh9-qg68-vxp4
2026-10-07 CISA SSVC decision points changed

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-105646

Other 5

TI-2026-21459 Ghost has a SQL Injection in its Content API CVSS 3.1CRITICAL 9.4
TI-2022-10277 An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows… CVSS 3.1CRITICAL 9.8
TI-2024-22785 Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit… CVSS 3.1CRITICAL 9.1
TI-2023-14843 Ghost vulnerable to disclosure of private API fields CVSS 3.1HIGH 7.5
TI-2025-09049 Ghost 6.0.6 - SSRF via oEmbed Bookmark CVSS 4.0MEDIUM 6.1
TI-2023-20918 Arbitrary file read via symlinks in Ghost CVSS 3.1MEDIUM 6.5

See all 109 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences