# CVE-2026-105646: Ghost regex denial of service in content import

Source: https://junglewise.ai/threats/cve-2026-105646-ghost-is-a-node-js-content-management-system-from-4-0-0-until-6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105646 · Severity: medium · CVSS 4.9 · Published 2026-10-05

Ghost is a Node.js-based content management system used to publish and manage websites and blogs. A maliciously crafted content import file can trigger excessive CPU usage and render the Ghost server unresponsive. An attacker with administrator credentials can exploit this to cause a denial of service.

Technologies: [Ghost](https://junglewise.ai/threats/technologies/ghost-ghost), [ghost (npm)](https://junglewise.ai/threats/technologies/ghost). Vendors: [Ghost](https://junglewise.ai/threats/vendors/ghost), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-105646 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105646 being exploited in the wild.

**How severe is CVE-2026-105646?** Medium severity, with a CVSS score of 4.9, published 5 October 2026.

**Which products and versions are affected?** Ghost 4.0.0 until 6.67.0; ghost (npm) >= 4.0.0, < 6.67.0, SEMVER:introduced=4.0.0,fixed=6.67.0.

**Is there a fix for CVE-2026-105646?** Yes. ghost (npm): upgrade to 6.67.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105646 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105646?** Check whether you run Ghost or ghost (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ghost (npm): upgrade to 6.67.0 or later

  ```sh
  npm install ghost@6.67.0
  ```


## Technical details

The vulnerability is a regular expression denial of service (ReDoS) flaw in Ghost's content import handler that processes regex patterns without proper escaping. An authenticated administrator can supply a specially crafted import file that causes catastrophic backtracking in regex evaluation, consuming excessive CPU resources and making the server unresponsive. The fix escapes user-supplied input before constructing regular expressions.

## Affected products

- Ghost Ghost 4.0.0 until 6.67.0

## Identifiers

- CVE-2026-105646
- GHSA-fwh9-qg68-vxp4

## Timeline

- 2026-10-05: disclosed
- 2026-09-28: patched

## References

- [https://github.com/TryGhost/Ghost/commit/88ae6d6d56f8a239cb38a8c89de02f034f50e2ce](https://github.com/TryGhost/Ghost/commit/88ae6d6d56f8a239cb38a8c89de02f034f50e2ce)
- [https://github.com/TryGhost/Ghost/pull/31058](https://github.com/TryGhost/Ghost/pull/31058)

## Related threats

- [Ghost: Path Traversal Vulnerability in Ghost ImageSize Service](https://junglewise.ai/threats/cve-2026-105683-ghost-is-a-node-js-content-management-system-from-6-14-0-until-6)
- [Ghost: Server-Side Request Forgery in Webhook Trigger](https://junglewise.ai/threats/cve-2026-105682-ghost-is-a-node-js-content-management-system-from-1-18-0-until-6)
- [Ghost input validation bypass in comments access control](https://junglewise.ai/threats/cve-2026-105681-ghost-is-a-node-js-content-management-system-from-5-9-0-until-6)
- [Ghost authorization bypass in post deletion](https://junglewise.ai/threats/cve-2026-105680-ghost-is-a-node-js-content-management-system-from-5-81-0-until-6)
- [Ghost content type validation bypass in local file storage](https://junglewise.ai/threats/cve-2026-105679-ghost-is-a-node-js-content-management-system-from-6-22-1-until-6)