Ghost: Regular Expression Denial of Service in External Media Inliner

Impact A crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. Vulnerable versions This vulnerability is present in Ghost from v5.37.0 up to v6.65.0. Patches v6.67.0 contains a fix for th...

GHSA-9M4W-FMJW-FVJQ Ghost: Regular Expression Denial of Service in External Media Inliner

Impact A crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. Vulnerable versions This vulnerability is present in Ghost from v5.37.0 up to v6.65.0. Patches v6.67.0 contains a fix for th...

NPM: Ghost: Regular Expression Denial of Service in External Media Inliner

NPM: Ghost: Regular Expression Denial of Service in External Media Inliner vulnerability discovered by ? in WordPress Npm ghost versions = 5.37.0, 6.67.0...

Ghost: Regular Expression Denial of Service in Content Import

Impact A crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. Vulnerable versions This vulnerability is present in Ghost from v4.0.0 up to v6.65.0. Patches v6.67.0 contains a fix for this issue. How to...

NPM: Ghost: Regular Expression Denial of Service in Content Import

NPM: Ghost: Regular Expression Denial of Service in Content Import vulnerability discovered by ? in WordPress Npm ghost versions = 4.0.0, 6.67.0...

CVE-2026-105646

The Ghost Node.js content management system is vulnerable to a Regular Expression Denial of Service (ReDoS) in its content import functionality. Specifically, versions 4.0.0 through 6.67.0 allow a crafted content import file to cause excessive CPU usage , potentially rendering the server unrespon...

CVE-2026-105645 Ghost: Regular Expression Denial of Service in External Media Inliner

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

CVE-2026-105645 Ghost: Regular Expression Denial of Service in External Media Inliner

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

CVE-2026-105645

The Ghost Node.js content management system is vulnerable to a Regular Expression Denial of Service (ReDoS) in its external media inliner component. Versions from 5.37.0 until 6.67.0 are affected, where a crafted request can trigger excessive CPU usage, leading to server unresponsiveness. Exploit...

CVE-2026-105219

Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in...

EUVD-2026-92122

Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in...

PT-2026-104648

Name of the Vulnerable Software and Affected Versions Mammoth.js versions 1.3.0 through 1.12.2 Description A regular expression denial of service occurs in the style map tokeniser located in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. An attacker can provide a specially...

CVE-2026-105219: Inefficient Regular Expression Complexity

Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in...

PT-2026-105914

Summary soupsieve compiles CSS selector strings with a set of hand-written regular expressions. The shared IDENTIFIER sub-pattern also embedded in VALUE, and therefore in attribute selectors places two adjacent quantified groups over overlapping character classes: ?:classA|ESC+?:classB|ESC, where...

Rocky Linux 9 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging / nodejs-packaging-bundler Multiple Vulnerabilities (crlsa-2023_5363)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20235363 advisory. nodejs: Permissions policies can be bypassed via Module.load CVE-2023-32002 nodejs-semver: Regular expression denial of service CVE-2022-25883 nodejs:...

Rocky Linux 9 [CIQ] Security Update: python3-setuptools / python3-setuptools-wheel (crlsa-2023_0952)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20230952 advisory. pypa-setuptools: Regular Expression Denial of Service ReDoS in packageindex.py CVE-2022-40897 Tenable has extracted the preceding description block directly from th...

Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging Multiple Vulnerabilities (crlsa-2023_5360)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20235360 advisory. nodejs: Permissions policies can be bypassed via Module.load CVE-2023-32002 nodejs-semver: Regular expression denial of service CVE-2022-25883 nodejs:...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2021_5171)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20215171 advisory. nodejs-json-schema: Prototype pollution vulnerability CVE-2021-3918 nodejs-ini: Prototype pollution via malicious INI file CVE-2020-7788 nodejs-glob-parent...

EUVD-2026-89484

anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js...

CVE-2026-103043

anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js...