npmPackage

payload

29 known vulnerabilities (4 critical, 13 high, 11 medium), with the versions each affects and the releases that fix them.

Latest release: 3.93.0 (Nov 4, 2026): no advisory affects it
Newest unaffected release: 3.93.0 (Nov 4, 2026), the latest release
Advisories: 29 · 4 critical, 13 high, 11 medium

Weekly downloads: 1.5M
Dependents: 69
Releases: 500+ since 3.64.0 (Nov 13, 2025)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-105868
Affects 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it)
CVE-2026-105866
Affects 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it)
CVE-2026-105865
Affects 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it)
CVE-2026-105863
Affects 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it)
CVE-2026-105862
Affects 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it)
CVE-2026-105861
Affects 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it)
CVE-2026-105859
Affects 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it)
CVE-2026-105858
Affects 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it)
CVE-2026-105855
Affects 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it)
CVE-2026-105854
Affects 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it)
CVE-2026-105853
Affects 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it)
CVE-2026-105852
Affects 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it)

Show all 29 advisoriesShow fewer advisories

CVE-2026-105849
Affects 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it)
CVE-2026-105847
Affects 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it)
CVE-2026-105846
Affects 3.62.0-internal.2a2d1e1 to 3.87.1 (3.88.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.26 (4.0.0-canary.27 is outside it)
CVE-2026-105845
Affects 3.62.0-internal.2a2d1e1 to 3.87.1 (3.88.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.26 (4.0.0-canary.27 is outside it)
CVE-2026-105805
Affects 3.62.0-internal.2a2d1e1 to 3.87.1 (3.88.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.26 (4.0.0-canary.27 is outside it)
CVE-2026-105804
Affects 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it)
CVE-2026-11779
Affects 3.62.0-internal.2a2d1e1 to 3.88.0 (3.89.0-internal.4b0e9b6 is outside it)
CVE-2026-34749
Affects 3.62.0-internal.2a2d1e1 to 3.79.0 (3.79.1 is outside it)
CVE-2026-34747
Affects 3.62.0-internal.2a2d1e1 to 3.79.0 (3.79.1 is outside it)
CVE-2026-34746
Affects 3.62.0-internal.2a2d1e1 to 3.79.0 (3.79.1 is outside it)
CVE-2026-34751
Affects 3.62.0-internal.2a2d1e1 to 3.79.0 (3.79.1 is outside it)
CVE-2026-27567
Affects 3.62.0-internal.2a2d1e1 to 3.75.0-internal.e61a4d7 (3.75.0 is outside it)
CVE-2026-25574
Affects 3.62.0-internal.2a2d1e1 to 3.74.0-internal-debug.1b84a48 (3.74.0 is outside it)
CVE-2025-4644
No published release is affected
No published release is affected
CVE-2025-4643
No published release is affected
No published release is affected
CVE-2023-30843
No published release is affected
No published release is affected
CVE-2022-27952
No published release is affected
No published release is affected

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 29

CVE-2026-105868High 8.6
Payload: Uploaded XML files could execute same-origin JavaScript
Affected: fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34.
Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure).
The latest release, 3.93.0, is not affected.
32% of payload downloads last week were affected versions (510.7K).
CVE-2026-105866Medium 6.9
Payload: Unauthenticated account-lockout denial of service
Affected: fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34.
Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure).
The latest release, 3.93.0, is not affected.
32% of payload downloads last week were affected versions (510.7K).
CVE-2026-105865High 8.1
Payload: Incomplete validation during the upload file lifecycle
Affected: fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34.
Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure).
The latest release, 3.93.0, is not affected.
32% of payload downloads last week were affected versions (510.7K).
CVE-2026-105863Critical 9.2
Payload authentication token field handling issue
Affected: from 3.0.0, fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34.
Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure).
The latest release, 3.93.0, is not affected.
30% of payload downloads last week were affected versions (478.9K).
CVE-2026-105862High 8.7
Payload: Bypassed sanitization of user uploaded SVGs
Affected: fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34.
Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure).
The latest release, 3.93.0, is not affected.
32% of payload downloads last week were affected versions (510.7K).
CVE-2026-105861High 7.2
Payload external upload trust validation issue
Affected: from 3.0.0, fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34.
Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure).
The latest release, 3.93.0, is not affected.
30% of payload downloads last week were affected versions (478.9K).
CVE-2026-105859Critical 9.8
Payload: Unauthorized update to collection documents
Affected: fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34.
Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure).
The latest release, 3.93.0, is not affected.
32% of payload downloads last week were affected versions (510.7K).
CVE-2026-105858High 8.1
Payload: Remote Code Execution through first-register
Affected: fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34.
Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure).
The latest release, 3.93.0, is not affected.
32% of payload downloads last week were affected versions (510.7K).
CVE-2026-105855High 7.6
Payload: Field-level password update restrictions were not enforced
Affected: fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34.
Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure).
The latest release, 3.93.0, is not affected.
32% of payload downloads last week were affected versions (510.7K).
CVE-2026-105854High 8.7
Payload: ReDoS in Multipart Content-Type Validation
Affected: from 3.0.0, fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34.
Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure).
The latest release, 3.93.0, is not affected.
30% of payload downloads last week were affected versions (478.9K).
CVE-2026-105853High 7.1
Payload: Token refresh and password reset responses may expose restricted user fields
Affected: from 3.0.0, fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34.
Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure).
The latest release, 3.93.0, is not affected.
30% of payload downloads last week were affected versions (478.9K).
CVE-2026-105852Medium 6.9
Payload relationship-query authorization bypass
Affected: fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34.
Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure).
The latest release, 3.93.0, is not affected.
32% of payload downloads last week were affected versions (510.7K).
CVE-2026-105849High 7.7
Payload: API key disclosure through ordinary document reads
Affected: from 3.0.0, fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34.
Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure).
The latest release, 3.93.0, is not affected.
30% of payload downloads last week were affected versions (478.9K).
CVE-2026-105847High 7.1
Payload: Polymorphic join queries could disclose hidden fields
Affected: from 3.0.0, fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34.
Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure).
The latest release, 3.93.0, is not affected.
30% of payload downloads last week were affected versions (478.9K).
CVE-2026-105846Medium 6.1
Payload: Untrusted redirect URL parameter exploit
Affected: from 3.40.0, fixed in 3.88.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.27.
Fixed in 3.88.0 (released Aug 11, 2026, 56 days before disclosure) and 4.0.0-canary.27 (released Aug 11, 2026, 56 days before disclosure).
The latest release, 3.93.0, is not affected.
22% of payload downloads last week were affected versions (348.7K).

Show all 29 advisoriesShow fewer advisories

CVE-2026-105845Critical 9.8
Payload: SQL Injection in SQLite and Postgres
Affected: from 3.0.0, fixed in 3.88.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.27.
Fixed in 3.88.0 (released Aug 11, 2026, 56 days before disclosure) and 4.0.0-canary.27 (released Aug 11, 2026, 56 days before disclosure).
The latest release, 3.93.0, is not affected.
23% of payload downloads last week were affected versions (370.4K).
CVE-2026-105805Medium 6.9
Payload: Sort queries could expose protected field information
Affected: fixed in 3.88.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.27.
Fixed in 3.88.0 (released Aug 11, 2026, 56 days before disclosure) and 4.0.0-canary.27 (released Aug 11, 2026, 56 days before disclosure).
The latest release, 3.93.0, is not affected.
25% of payload downloads last week were affected versions (402.3K).
CVE-2026-105804Medium 5.7
Payload: Password hashes use insufficient PBKDF2 iterations
Affected: from 3.0.0, fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34.
Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure).
The latest release, 3.93.0, is not affected.
30% of payload downloads last week were affected versions (478.9K).
CVE-2026-11779Medium 5.3
PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access
Affected: versions 3.84.1; through 3.88.0.
Fixed in 3.89.0 (released Sep 10, 2026, 76 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 3.93.0, is not affected.
30% of payload downloads last week were affected versions (483.1K).
CVE-2026-34749Medium 5.4
Payload has a CSRF Protection Bypass in Authentication Flow
Affected: fixed in 3.79.1.
Fixed in 3.79.1 (released Mar 16, 2026, 16 days before disclosure).
The latest release, 3.93.0, is not affected.
11% of payload downloads last week were affected versions (185.8K).
CVE-2026-34747High 8.5
Payload has an SQL Injection via Query Handling
Affected: fixed in 3.79.1.
Fixed in 3.79.1 (released Mar 16, 2026, 16 days before disclosure).
The latest release, 3.93.0, is not affected.
11% of payload downloads last week were affected versions (185.8K).
CVE-2026-34746High 7.7
Payload has Authenticated SSRF via Upload Functionality
Affected: fixed in 3.79.1.
Fixed in 3.79.1 (released Mar 16, 2026, 16 days before disclosure).
The latest release, 3.93.0, is not affected.
11% of payload downloads last week were affected versions (185.8K).
CVE-2026-34751Critical 9.1
Payload has Unvalidated Input in Password Recovery Endpoints
Affected: fixed in 3.79.1.
Fixed in 3.79.1 (released Mar 16, 2026, 16 days before disclosure).
The latest release, 3.93.0, is not affected.
11% of payload downloads last week were affected versions (185.8K).
CVE-2026-27567Medium 6.5
Payload has Server-Side Request Forgery (SSRF) in External File URL Uploads
Affected: fixed in 3.75.0.
Fixed in 3.75.0 (released Feb 5, 2026, 19 days before disclosure).
The latest release, 3.93.0, is not affected.
10% of payload downloads last week were affected versions (169.3K).
CVE-2026-25574Medium 5.4
Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments)
Affected: fixed in 3.74.0.
Fixed in 3.74.0 (released Jan 30, 2026, 7 days before disclosure).
The latest release, 3.93.0, is not affected.
10% of payload downloads last week were affected versions (167.1K).
CVE-2025-4644Medium 5.3
User Session Fixation after Account Removal in PayloadCMS
Affected: fixed in 3.44.0.
Fixed in 3.44.0.
The latest release, 3.93.0, is not affected.
3.5% of payload downloads last week were affected versions (57.2K).
CVE-2025-4643Medium 6.3
Lack of JWT Expiration after Log Out in PayloadCMS
Affected: fixed in 3.44.0.
Fixed in 3.44.0.
The latest release, 3.93.0, is not affected.
3.5% of payload downloads last week were affected versions (57.2K).
CVE-2023-30843High 7.4
Payload's hidden fields can be leaked on readable collections
Affected: fixed in 1.7.0.
Fixed in 1.7.0.
The latest release, 3.93.0, is not affected.
0.6% of payload downloads last week were affected versions (9.1K).
CVE-2022-27952Unrated
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a…
Affected: fixed in 0.15.1.
Fixed in 0.15.1.
The latest release, 3.93.0, is not affected.
0.3% of payload downloads last week were affected versions (5.6K).