CVE-2026-53945CWE-367CWE-918

Ghost: Server-side request forgery via DNS rebinding in external request handling

Medium · published June 24, 2026

CVSS v3.1
4.0
EPSS
0%
Percentile
11.2
In the wild
Unconfirmed
What it is

Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, Ghost’s private-IP check for outbound HTTP requests could be bypassed via DNS rebinding, allowing an attacker to coerce the Ghost server into reaching hosts on internal networks through features that issue external fetches. This vulnerability is fixed in 6.21.1.

The record
Technical detail
CVSS v3.1
4.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00214 · 11.2th percentile
Weaknesses
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-06-24T18:09Z
EPSS history
Timeline
  • 24 JUN 18:09Z
    Ghost: Server-side request forgery via DNS rebinding in external request handling
    cvelistv5