Skip to content
QuenchWorks

ghost

Chart · Apps & productivity · standard · v0.0.40

digest pinnedcosign signedSPDX SBOMSLSA provenanceamd64 · arm64Rebuilt 2026-10-22

Open-source Node.js publishing platform for blogs, newsletters, and membership sites. Packaged from Ghost's official npm distribution on a hardened Wolfi Node 22; configured entirely via environment and backed by an external MySQL/MariaDB with a content PVC for themes, images, and data.

Version

0.0.40 · latest0.0.390.0.38

The latest line lives at the base page; older lines have their own page so you can pin and verify exactly that version. Only the most recent releases are listed — an older chart pins an older image digest.

Deployed image digest

sha256:e1ea09ec4334649f8d7d46633b7d02d43db529415170e1a5148b0d12a967909f

Chart OCI version

oci://ghcr.io/quenchworks/charts/ghost:0.0.40

The chart pins its image by this signed digest, so you never track it yourself. Signatures, SBOM, and provenance attach to the same digest.

Signed
cosign keyless
SBOM
SPDX, on image
Provenance
SLSA build
Architectures
amd64, arm64
Runs as
nonroot (uid 1001)
Root filesystem
read-only
Image size
192.8 MB

Security report (Trivy)

F· 0/10043 fixable · rebuild clears them

Vulnerability detail

ghost 6.67.0 · 47 CVE
CVESeverityPackageInstalledFixed inTitle
GHSA-cg2g-xh64-v4q7CRITICALdompurify3.4.163.4.17DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
CVE-2026-105482HIGHnodejs-2222.23.2-r122.23.4-r0nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character
CVE-2026-106069HIGHnodejs-2222.23.2-r122.23.4-r0nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames
CVE-2026-109383HIGHundici6.28.16.29.1, 7.30.1, 8.12.2undici: undici: Certificate validation bypass via dropped TLS options in Agent
CVE-2026-109383HIGHundici7.29.16.29.1, 7.30.1, 8.12.2undici: undici: Certificate validation bypass via dropped TLS options in Agent
CVE-2026-109383HIGHundici8.10.26.29.1, 7.30.1, 8.12.2undici: undici: Certificate validation bypass via dropped TLS options in Agent
CVE-2026-109829HIGHundici7.29.17.30.1, 8.12.2undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching
CVE-2026-109829HIGHundici8.10.27.30.1, 8.12.2undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching
CVE-2026-109869HIGHundici6.28.16.29.1, 7.30.1, 8.12.2undici: undici: Denial of Service via unhandled stream error on excessive content encodings
CVE-2026-109869HIGHundici7.29.16.29.1, 7.30.1, 8.12.2undici: undici: Denial of Service via unhandled stream error on excessive content encodings
CVE-2026-109869HIGHundici8.10.26.29.1, 7.30.1, 8.12.2undici: undici: Denial of Service via unhandled stream error on excessive content encodings
CVE-2026-111181HIGHbody-parser1.20.62.4.0, 1.20.9body-parser: body-parser: Denial of Service via unhandled decompression stream error
CVE-2026-111181HIGHbody-parser1.20.82.4.0, 1.20.9body-parser: body-parser: Denial of Service via unhandled decompression stream error
CVE-2026-113872HIGHmulter2.4.02.5.0multer: multer: Denial of Service via aborted request during asynchronous file filtering
CVE-2026-87018HIGHundici6.28.16.29.1, 7.30.1, 8.12.2undici: undici: Denial of Service via TLS renegotiation with mismatched certificate
CVE-2026-87018HIGHundici7.29.16.29.1, 7.30.1, 8.12.2undici: undici: Denial of Service via TLS renegotiation with mismatched certificate
CVE-2026-87018HIGHundici8.10.26.29.1, 7.30.1, 8.12.2undici: undici: Denial of Service via TLS renegotiation with mismatched certificate
GHSA-mrv2-3pqr-j5jrHIGHdompurify3.4.163.4.17DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
CVE-2026-19693HIGHextract-zip2.0.1— not fixableextract-zip: extract-zip: Arbitrary file write via symlink in archive
CVE-2026-56876HIGHextract-zip2.0.1— not fixableextract-zip: github.com/maxogden/extract-zip: extract-zip: Arbitrary file write and information disclosure via symlink validation bypass
CVE-2026-105481MEDIUMnodejs-2222.23.2-r122.23.4-r0nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse
CVE-2026-106072MEDIUMnodejs-2222.23.2-r122.23.4-r0nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification
CVE-2026-106074MEDIUMnodejs-2222.23.2-r122.23.4-r0nodejs: nodejs: predictable random values via snapshot entropy cache reuse
CVE-2026-109841MEDIUMundici7.29.17.30.1, 8.12.2undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens
CVE-2026-109841MEDIUMundici8.10.27.30.1, 8.12.2undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens
CVE-2026-109924MEDIUMundici6.28.16.29.1, 7.30.1, 8.12.2undici: undici: Denial of Service via memory exhaustion in EventSource client
CVE-2026-109924MEDIUMundici7.29.16.29.1, 7.30.1, 8.12.2undici: undici: Denial of Service via memory exhaustion in EventSource client
CVE-2026-109924MEDIUMundici8.10.26.29.1, 7.30.1, 8.12.2undici: undici: Denial of Service via memory exhaustion in EventSource client
CVE-2026-109932MEDIUMundici6.28.16.29.1, 7.30.1, 8.12.2undici: undici: Denial of Service via unbounded WebSocket PONG buffering
CVE-2026-109932MEDIUMundici7.29.16.29.1, 7.30.1, 8.12.2undici: undici: Denial of Service via unbounded WebSocket PONG buffering
CVE-2026-109932MEDIUMundici8.10.26.29.1, 7.30.1, 8.12.2undici: undici: Denial of Service via unbounded WebSocket PONG buffering
CVE-2026-110180MEDIUMfast-uri3.1.82.4.8, 3.1.9, 4.2.3fast-uri: fast-uri: Security policy bypass via improper host canonicalization
CVE-2026-110306MEDIUMfast-uri3.1.82.4.8, 3.1.9, 4.2.3fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding
CVE-2026-110816MEDIUMqs6.16.06.16.1qs: qs: Denial of Service via unhandled exception during array serialization
CVE-2026-87029MEDIUMundici7.29.17.30.1, 8.12.2undici: undici: Denial of Service via unhandled exception in decompress interceptor
CVE-2026-87029MEDIUMundici8.10.27.30.1, 8.12.2undici: undici: Denial of Service via unhandled exception in decompress interceptor
GHSA-4ffr-jq9g-5ffxMEDIUMnodemailer10.0.1010.0.13Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service
GHSA-85x2-q946-cp5hMEDIUMnodemailer10.0.1010.1.4Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
GHSA-8c8m-p3m8-cjg8MEDIUMnodemailer10.0.1010.1.4Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
GHSA-g73g-hqqh-jr95MEDIUMnodemailer10.0.1010.0.13Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped
GHSA-m943-m63m-w62wMEDIUMnodemailer10.0.1010.1.4Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
GHSA-984p-xq9m-4rjwMEDIUMexpress-brute1.0.1— not fixableRate Limiting Bypass in express-brute
CVE-2026-106073LOWnodejs-2222.23.2-r122.23.4-r0nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()
CVE-2026-110095LOWfast-uri3.1.82.4.8, 3.1.9, 4.2.3fast-uri: fast-uri: Path traversal via improper relative URI normalization
CVE-2026-110725LOWfast-uri3.1.82.4.8, 3.1.9, 4.2.3fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths
GHSA-c6gr-qvv4-5v3fLOWdompurify3.4.163.4.17DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
CVE-2026-93753LOWdeepmerge4.3.1— not fixabledeepmerge: deepmerge: Prototype Poisoning via mergeObject function
1
Critical
19
High
22
Medium
5
Low
0
Unknown

Security report (Trivy) · image ghost 6.67.0

Install the chart

Deploy to Kubernetes with hardened defaults. The chart pins its image by signed digest, so you never track it yourself.

Install (latest)

helm install my-ghost oci://ghcr.io/quenchworks/charts/ghost --version 0.0.40

Deploys images (digest-pinned)

Chart version
0.0.40
App version
6.67.0
Chart license
MIT
App license
MIT
Service port
2368
Signed
cosign (keyless)
Values schema
yes
Last published
2026-10-22
Values keys
  • image: repository digest pullPolicy
  • nameOverride
  • replicaCount
  • ghost: url
  • resources: requests limits
  • service: type port
  • persistence: enabled size mountPath accessModes annotations existingClaim
  • mariadb: enabled auth primary
  • externalDatabase: host port database user password existingSecret existingSecretPasswordKey
  • podLabels
  • podAnnotations
  • nodeSelector
  • affinity
  • tolerations
  • topologySpreadConstraints
  • priorityClassName
  • schedulerName
  • terminationGracePeriodSeconds
  • updateStrategy
  • extraEnvVars
  • extraEnvVarsCM
  • extraEnvVarsSecret
  • extraVolumes
  • extraVolumeMounts
  • initContainers
  • sidecars
  • lifecycleHooks
  • command
  • args
  • podSecurityContext
  • containerSecurityContext: readOnlyRootFilesystem
  • livenessProbe
  • readinessProbe
  • customLivenessProbe
  • customReadinessProbe
  • customStartupProbe: httpGet periodSeconds timeoutSeconds failureThreshold
  • serviceAccount: create name annotations
  • rbac: create
  • networkPolicy: enabled allowExternal
  • podDisruptionBudget: enabled minAvailable
  • ingress: enabled className annotations servicePort hosts tls

Verify the chart

cosign verify ghcr.io/quenchworks/charts/ghost:0.0.40 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Transparency

The chart publishes its attestations on GitHub and the image it deploys carries its own on the same digest, publicly verifiable with the commands above. Both log to the Sigstore transparency log (Rekor), which cosign verify checks for you.

View the imageView on ArtifactHubChart source

Upstream project: https://ghost.org