CVE-2026-105648

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0.

CVSS 3.1

4.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-25)

CWEs

CWE-184, CWE-918

Published

2026-10-05

Modified

2026-10-06

Record from

the NVD, synced 2026-10-19

Packages (OSV)

References

• https://github.com/TryGhost/Ghost/commit/20d3f792bf4a7c349ee56b746a067550d8684ff5
• https://github.com/TryGhost/Ghost/pull/30917
• https://github.com/TryGhost/Ghost/releases/tag/v6.65.0
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-r7f2-6fj8-6fg2

Check your stackJSON