CVE-2026-53944: Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, when making an external request, it is possible t…
Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, when making an external request, it is possible to bypass the IP filter that ensures the request isn't going to an internal service using an IPv6 literal which maps to a private IPv4 address. This vulnerability is fixed in 6.21.1.
- Published by source
- 2026-06-24
- First seen by Reality Radar
- 2026-10-26
- Last verified
- 2026-10-26
What the official notice says
Risk: CVSS 5.8
Is this affecting you?
Add what you own or use and Reality Radar will tell you when official changes match it — with evidence and next steps.
Sources
- NIST National Vulnerability Database Tier A · official published 2026-06-24
Evidence ledger
Every piece of evidence we store is appended to a public hash chain, so later edits are detectable. Anyone can re-verify it.
| Entry | Kind | Observed | Evidence hash | Entry hash |
|---|---|---|---|---|
| #1739 | new | 2026-10-26 | 099ad6d377e7…e77786 | 4cdef8222df1…501028 |
Chain head: #1771 9d8a5938d304…171807