CVE-2026-105645: Regular Expression Denial of Service (ReDoS) in Ghost CMS

The vulnerability identified as CVE-2026-105645 (GHSA-9m4w-fmjw-fvjq) represents a medium-severity Regular Expression Denial of Service (ReDoS) flaw in the core architecture of Ghost, a widely-deployed open-source Node.js Content Management System (CMS). The defect manifests in two distinct functional modules: the directory import subsystem (responsible for parsing content archives) and the External Media Inliner service (designed to retrieve external media during database migrations).

An authenticated attacker with administrative privileges can exploit this weakness by submitting input patterns specifically crafted to induce catastrophic backtracking in the V8 JavaScript regular expression engine. Because Node.js is built on a single-threaded execution model, a CPU-bound operation like regular expression backtracking blocks the entire event loop, preventing the server from processing any subsequent incoming HTTP requests.

The impact is confined to application availability, resulting in a complete denial of service for the target instance. The issue affects Ghost versions ranging from 5.37.0 up to (but not including) 6.67.0. Mitigation involves updating to version 6.67.0, which introduces comprehensive input escaping for import pathways and enforces execution time limits via a separate virtual machine context for wildcard domain matching.

The fundamental cause of the vulnerability lies in the use of user-controlled inputs during the dynamic compilation of regular expressions. Within the import handlers, Ghost dynamically constructs regular expressions to normalize archive directory layouts and match static file prefixes using path-derived variables such as baseDir and startDir. When constructing these regular expressions, the engine did not escape or validate literal directory paths before appending them directly into the regular expression constructor.

If an administrator uploads an archive where a folder name contains regex metacharacters with nested quantifiers, such as (a+)+b, the variable is evaluated directly. This causes the regular expression parser to interpret the path as an active pattern rather than a literal string. When matching a filename like aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaac.jpg against /^(a+)+b//, the engine evaluates exponential combinations of the character group before encountering the non-matching character at the end, leading to catastrophic backtracking.

In the External Media Inliner service, the root cause is slightly different but yields the same system-level outcome. The service parses post contents to discover and download media from external wildcards. Because these external domains contain intentional wildcards (e.g., https?://i[0-9]{1}.wp.com), escaping is not viable. The combined regular expression built to locate matches is evaluated synchronously without any execution time bounds. An attacker-controlled wildcard domain containing nested groupings evaluated against long, repetitive structures inside post contents can indefinitely starve the event loop.

An examination of the fix commit (88ae6d6d56f8a239cb38a8c89de02f034f50e2ce) reveals a two-pronged remediation strategy designed by the maintainers. For the directory import handlers, the dynamic path compilation is secured by integrating lodash's escaping library. By wrapping the variable parameters inside _.escapeRegExp(), all metacharacters are safely escaped, ensuring that V8 evaluates folder structures purely as literal sequences of characters.

In contrast, the External Media Inliner requires wildcard evaluation to perform its core tasks. Because escaping would destroy the wildcard functionality, the developers utilized the Node.js node:vm standard library module. This module permits executing JavaScript scripts within an isolated V8 context under strict performance criteria.

// A snippet illustrating the sandbox matching model introduced in the patch
const vm = require('node:vm');
const FIND_MATCHES_TIMEOUT_MS = 1000;
 
let findMatchesScript;
let findMatchesContext;
 
function matchAllWithTimeout(content, regex, timeout) {
  if (!findMatchesScript) {
    findMatchesScript = new vm.Script('Array.from(content.matchAll(regex), (match) => match[1])');
    findMatchesContext = vm.createContext({});
  }
  findMatchesContext.content = content;
  findMatchesContext.regex = regex;
  try {
    return Array.from(findMatchesScript.runInContext(findMatchesContext, { timeout }));
  } finally {
    findMatchesContext.content = undefined;
    findMatchesContext.regex = undefined;
  }
}

By executing the regex search within a sandbox with a timeout of 1000 milliseconds, the engine guarantees that any search requiring intensive backtracking is terminated. When the timeout threshold is breached, the runtime throws an ERR_SCRIPT_EXECUTION_TIMEOUT exception, which is caught and handled gracefully by logging the failure and continuing processing. This ensures the single-threaded event loop is freed up for pending networking tasks.

Exploitation requires administrative-level authentication to target either the directory import system or the media inliner configuration settings. An attacker begins by packaging a ZIP archive that mirrors the structure of an image or content import. The attacker names one of the directories within the archive (a+)+b. Inside this directory, the attacker places a file named aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaac.jpg.

Upon uploading this file via the Ghost admin control panel, the application invokes the loadFile() method inside the ImporterContentFileHandler or ImageHandler modules. The server extracts the archive, retrieves the path string, and initiates the dynamic compilation step: const baseDirRegex = new RegExp('^' + baseDir + '/'). The resulting regular expression /^(a+)+b// is then matched against the long name of the nested file. This starts the catastrophic backtracking process, forcing the CPU core hosting the Ghost instance to 100% capacity and preventing incoming connection responses.

Alternatively, the attacker can leverage the External Media Inliner. The attacker registers or specifies a domain pattern containing nested-backtracking sequences, such as (a+)+b. By subsequently creating or importing post content that contains a lengthy, repetitive sequence of characters that lacks the terminating character (such as 40 characters of 'a' followed by a 'c'), the attacker triggers the processing queue. When inlineContent() executes, the synchronous call to findMatches() matches the malicious content against the vulnerable domain pattern, stalling the entire application.

This vulnerability has been assigned a CVSS v3.1 base score of 4.9 (Medium), with a vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. The assessment reflects a high impact on availability, balanced by the requirement for administrative privileges (PR:H). Because administrative access is necessary to initiate ZIP imports or configure external media services, the likelihood of drive-by remote exploitation is minimal.

The consequence of a successful exploitation is a complete Denial of Service (DoS) of the Node.js application process. In single-instance deployments lacking auto-restarts or process monitoring, the server remains in a hung state indefinitely. In containerized environments managed by orchestrators like Kubernetes, the container may eventually trigger a liveness probe failure and restart, but repeated exploitation attempts can lead to a continuous crash-loop state, rendering the platform permanently unavailable.

Furthermore, because the synchronous timeout inside the patched version of the media inliner is capped at 1000 milliseconds, a sequence of multiple crafted payloads can still induce a temporary event loop lag. Although the immediate risk of infinite freezing is mitigated by the VM sandbox, administrators must remain vigilant against potential exploitation windows that could slow down legitimate HTTP traffic.