MEDIUM 4.0 GitHub
CVE-2026-53945
Ghost: Server-side request forgery via DNS rebinding in external request handling
### Impact
Ghost’s private-IP check for outbound HTTP requests could be bypassed via DNS rebinding, allowing an attacker to coerce the Ghost server into reaching hosts on internal networks through features that issue external fetches.
### Vulnerable versions
This vulnerability is present in Ghost from v6.0.9 up to v6.21.0.
### Patches
v6.21.1 contains a fix for this issue.
### How to update
For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/
Affected Products
- npm/ghost >= 6.0.9, < 6.21.1
References
- https://github.com/advisories/GHSA-ch52-px8q-f22j
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-ch52-px8q-f22j
- https://nvd.nist.gov/vuln/detail/CVE-2026-53945
- https://github.com/TryGhost/Ghost/pull/26754
This medium severity vulnerability with a CVSS score of 4.0 was published on 2026-08-04 via GitHub. Affected: npm/ghost >= 6.0.9, < 6.21.1.
vulnfeed aggregates 9182 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.