GHSA-62Q6-4HV4-VJRW Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header

Impact When Ghost is behind a shared caching layer that results in cached content being shared between different visitors e.g., Fastly, Cloudflare, nginx proxycache, and others, an unauthenticated user could send an x-ghost-preview header that altered the rendered frontend response. In affected...

CVE-2026-53943

The CVE-2026-53943 entry describes a Ghost CMS vulnerability where, on sites behind a shared caching layer, an unauthenticated user can send an x-ghost-preview header that poisons cached responses, altering rendered frontend output. In affected configurations, this cached, request-specific previe...

CVE-2026-53943 Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header

Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that results in cached content being shared between different visitors, an unauthenticated user could send an x-ghost-preview header that altered the rendered frontend response. In affecte...