# payload (npm) vulnerabilities 29 known vulnerabilities (4 critical, 13 high, 11 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 3.93.0 (Nov 4, 2026): no advisory affects it - Newest unaffected release: 3.93.0 (Nov 4, 2026), the latest release - Weekly downloads: 1.5M - Dependents: 69 - Releases: 500+ since 3.64.0 (Nov 13, 2025) - Registry: https://www.npmjs.com/package/payload - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-105868: 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it) - CVE-2026-105866: 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it) - CVE-2026-105865: 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it) - CVE-2026-105863: 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it) - CVE-2026-105862: 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it) - CVE-2026-105861: 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it) - CVE-2026-105859: 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it) - CVE-2026-105858: 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it) - CVE-2026-105855: 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it) - CVE-2026-105854: 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it) - CVE-2026-105853: 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it) - CVE-2026-105852: 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it) - CVE-2026-105849: 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it) - CVE-2026-105847: 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it) - CVE-2026-105846: 3.62.0-internal.2a2d1e1 to 3.87.1 (3.88.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.26 (4.0.0-canary.27 is outside it) - CVE-2026-105845: 3.62.0-internal.2a2d1e1 to 3.87.1 (3.88.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.26 (4.0.0-canary.27 is outside it) - CVE-2026-105805: 3.62.0-internal.2a2d1e1 to 3.87.1 (3.88.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.26 (4.0.0-canary.27 is outside it) - CVE-2026-105804: 3.62.0-internal.2a2d1e1 to 3.89.0 (3.90.0 is outside it); 4.0.0-canary.0 to 4.0.0-canary.33 (4.0.0-canary.34 is outside it) - CVE-2026-11779: 3.62.0-internal.2a2d1e1 to 3.88.0 (3.89.0-internal.4b0e9b6 is outside it) - CVE-2026-34749: 3.62.0-internal.2a2d1e1 to 3.79.0 (3.79.1 is outside it) - CVE-2026-34747: 3.62.0-internal.2a2d1e1 to 3.79.0 (3.79.1 is outside it) - CVE-2026-34746: 3.62.0-internal.2a2d1e1 to 3.79.0 (3.79.1 is outside it) - CVE-2026-34751: 3.62.0-internal.2a2d1e1 to 3.79.0 (3.79.1 is outside it) - CVE-2026-27567: 3.62.0-internal.2a2d1e1 to 3.75.0-internal.e61a4d7 (3.75.0 is outside it) - CVE-2026-25574: 3.62.0-internal.2a2d1e1 to 3.74.0-internal-debug.1b84a48 (3.74.0 is outside it) - CVE-2025-4644: no published release is affected - CVE-2025-4643: no published release is affected - CVE-2023-30843: no published release is affected - CVE-2022-27952: no published release is affected Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (29) ### [CVE-2026-105868](https://cve.now/CVE-2026-105868): Payload: Uploaded XML files could execute same-origin JavaScript - Severity: High 8.6 - Published: Oct 6, 2026 - Affected: fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34. - Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure). - The latest release, 3.93.0, is not affected. - 32% of payload downloads last week were affected versions (510.7K). ### [CVE-2026-105866](https://cve.now/CVE-2026-105866): Payload: Unauthenticated account-lockout denial of service - Severity: Medium 6.9 - Published: Oct 6, 2026 - Affected: fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34. - Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure). - The latest release, 3.93.0, is not affected. - 32% of payload downloads last week were affected versions (510.7K). ### [CVE-2026-105865](https://cve.now/CVE-2026-105865): Payload: Incomplete validation during the upload file lifecycle - Severity: High 8.1 - Published: Oct 6, 2026 - Affected: fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34. - Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure). - The latest release, 3.93.0, is not affected. - 32% of payload downloads last week were affected versions (510.7K). ### [CVE-2026-105863](https://cve.now/CVE-2026-105863): Payload authentication token field handling issue - Severity: Critical 9.2 - Published: Oct 6, 2026 - Affected: from 3.0.0, fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34. - Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure). - The latest release, 3.93.0, is not affected. - 30% of payload downloads last week were affected versions (478.9K). ### [CVE-2026-105862](https://cve.now/CVE-2026-105862): Payload: Bypassed sanitization of user uploaded SVGs - Severity: High 8.7 - Published: Oct 6, 2026 - Affected: fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34. - Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure). - The latest release, 3.93.0, is not affected. - 32% of payload downloads last week were affected versions (510.7K). ### [CVE-2026-105861](https://cve.now/CVE-2026-105861): Payload external upload trust validation issue - Severity: High 7.2 - Published: Oct 6, 2026 - Affected: from 3.0.0, fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34. - Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure). - The latest release, 3.93.0, is not affected. - 30% of payload downloads last week were affected versions (478.9K). ### [CVE-2026-105859](https://cve.now/CVE-2026-105859): Payload: Unauthorized update to collection documents - Severity: Critical 9.8 - Published: Oct 6, 2026 - Affected: fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34. - Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure). - The latest release, 3.93.0, is not affected. - 32% of payload downloads last week were affected versions (510.7K). ### [CVE-2026-105858](https://cve.now/CVE-2026-105858): Payload: Remote Code Execution through first-register - Severity: High 8.1 - Published: Oct 6, 2026 - Affected: fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34. - Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure). - The latest release, 3.93.0, is not affected. - 32% of payload downloads last week were affected versions (510.7K). ### [CVE-2026-105855](https://cve.now/CVE-2026-105855): Payload: Field-level password update restrictions were not enforced - Severity: High 7.6 - Published: Oct 6, 2026 - Affected: fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34. - Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure). - The latest release, 3.93.0, is not affected. - 32% of payload downloads last week were affected versions (510.7K). ### [CVE-2026-105854](https://cve.now/CVE-2026-105854): Payload: ReDoS in Multipart Content-Type Validation - Severity: High 8.7 - Published: Oct 6, 2026 - Affected: from 3.0.0, fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34. - Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure). - The latest release, 3.93.0, is not affected. - 30% of payload downloads last week were affected versions (478.9K). ### [CVE-2026-105853](https://cve.now/CVE-2026-105853): Payload: Token refresh and password reset responses may expose restricted user fields - Severity: High 7.1 - Published: Oct 6, 2026 - Affected: from 3.0.0, fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34. - Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure). - The latest release, 3.93.0, is not affected. - 30% of payload downloads last week were affected versions (478.9K). ### [CVE-2026-105852](https://cve.now/CVE-2026-105852): Payload relationship-query authorization bypass - Severity: Medium 6.9 - Published: Oct 6, 2026 - Affected: fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34. - Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure). - The latest release, 3.93.0, is not affected. - 32% of payload downloads last week were affected versions (510.7K). ### [CVE-2026-105849](https://cve.now/CVE-2026-105849): Payload: API key disclosure through ordinary document reads - Severity: High 7.7 - Published: Oct 6, 2026 - Affected: from 3.0.0, fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34. - Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure). - The latest release, 3.93.0, is not affected. - 30% of payload downloads last week were affected versions (478.9K). ### [CVE-2026-105847](https://cve.now/CVE-2026-105847): Payload: Polymorphic join queries could disclose hidden fields - Severity: High 7.1 - Published: Oct 6, 2026 - Affected: from 3.0.0, fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34. - Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure). - The latest release, 3.93.0, is not affected. - 30% of payload downloads last week were affected versions (478.9K). ### [CVE-2026-105846](https://cve.now/CVE-2026-105846): Payload: Untrusted redirect URL parameter exploit - Severity: Medium 6.1 - Published: Oct 6, 2026 - Affected: from 3.40.0, fixed in 3.88.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.27. - Fixed in 3.88.0 (released Aug 11, 2026, 56 days before disclosure) and 4.0.0-canary.27 (released Aug 11, 2026, 56 days before disclosure). - The latest release, 3.93.0, is not affected. - 22% of payload downloads last week were affected versions (348.7K). ### [CVE-2026-105845](https://cve.now/CVE-2026-105845): Payload: SQL Injection in SQLite and Postgres - Severity: Critical 9.8 - Published: Oct 6, 2026 - Affected: from 3.0.0, fixed in 3.88.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.27. - Fixed in 3.88.0 (released Aug 11, 2026, 56 days before disclosure) and 4.0.0-canary.27 (released Aug 11, 2026, 56 days before disclosure). - The latest release, 3.93.0, is not affected. - 23% of payload downloads last week were affected versions (370.4K). ### [CVE-2026-105805](https://cve.now/CVE-2026-105805): Payload: Sort queries could expose protected field information - Severity: Medium 6.9 - Published: Oct 6, 2026 - Affected: fixed in 3.88.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.27. - Fixed in 3.88.0 (released Aug 11, 2026, 56 days before disclosure) and 4.0.0-canary.27 (released Aug 11, 2026, 56 days before disclosure). - The latest release, 3.93.0, is not affected. - 25% of payload downloads last week were affected versions (402.3K). ### [CVE-2026-105804](https://cve.now/CVE-2026-105804): Payload: Password hashes use insufficient PBKDF2 iterations - Severity: Medium 5.7 - Published: Oct 6, 2026 - Affected: from 3.0.0, fixed in 3.90.0; from 4.0.0-canary.0, fixed in 4.0.0-canary.34. - Fixed in 3.90.0 (released Sep 18, 2026, 18 days before disclosure) and 4.0.0-canary.34 (released Sep 18, 2026, 18 days before disclosure). - The latest release, 3.93.0, is not affected. - 30% of payload downloads last week were affected versions (478.9K). ### [CVE-2026-11779](https://cve.now/CVE-2026-11779): PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access - Severity: Medium 5.3 - Published: Jun 26, 2026 - Affected: versions 3.84.1; through 3.88.0. - Fixed in 3.89.0 (released Sep 10, 2026, 76 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.93.0, is not affected. - 30% of payload downloads last week were affected versions (483.1K). ### [CVE-2026-34749](https://cve.now/CVE-2026-34749): Payload has a CSRF Protection Bypass in Authentication Flow - Severity: Medium 5.4 - Published: Apr 1, 2026 - Affected: fixed in 3.79.1. - Fixed in 3.79.1 (released Mar 16, 2026, 16 days before disclosure). - The latest release, 3.93.0, is not affected. - 11% of payload downloads last week were affected versions (185.8K). ### [CVE-2026-34747](https://cve.now/CVE-2026-34747): Payload has an SQL Injection via Query Handling - Severity: High 8.5 - Published: Apr 1, 2026 - Affected: fixed in 3.79.1. - Fixed in 3.79.1 (released Mar 16, 2026, 16 days before disclosure). - The latest release, 3.93.0, is not affected. - 11% of payload downloads last week were affected versions (185.8K). ### [CVE-2026-34746](https://cve.now/CVE-2026-34746): Payload has Authenticated SSRF via Upload Functionality - Severity: High 7.7 - Published: Apr 1, 2026 - Affected: fixed in 3.79.1. - Fixed in 3.79.1 (released Mar 16, 2026, 16 days before disclosure). - The latest release, 3.93.0, is not affected. - 11% of payload downloads last week were affected versions (185.8K). ### [CVE-2026-34751](https://cve.now/CVE-2026-34751): Payload has Unvalidated Input in Password Recovery Endpoints - Severity: Critical 9.1 - Published: Apr 1, 2026 - Affected: fixed in 3.79.1. - Fixed in 3.79.1 (released Mar 16, 2026, 16 days before disclosure). - The latest release, 3.93.0, is not affected. - 11% of payload downloads last week were affected versions (185.8K). ### [CVE-2026-27567](https://cve.now/CVE-2026-27567): Payload has Server-Side Request Forgery (SSRF) in External File URL Uploads - Severity: Medium 6.5 - Published: Feb 24, 2026 - Affected: fixed in 3.75.0. - Fixed in 3.75.0 (released Feb 5, 2026, 19 days before disclosure). - The latest release, 3.93.0, is not affected. - 10% of payload downloads last week were affected versions (169.3K). ### [CVE-2026-25574](https://cve.now/CVE-2026-25574): Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments) - Severity: Medium 5.4 - Published: Feb 6, 2026 - Affected: fixed in 3.74.0. - Fixed in 3.74.0 (released Jan 30, 2026, 7 days before disclosure). - The latest release, 3.93.0, is not affected. - 10% of payload downloads last week were affected versions (167.1K). ### [CVE-2025-4644](https://cve.now/CVE-2025-4644): User Session Fixation after Account Removal in PayloadCMS - Severity: Medium 5.3 - Published: Aug 29, 2025 - Affected: fixed in 3.44.0. - Fixed in 3.44.0. - The latest release, 3.93.0, is not affected. - 3.5% of payload downloads last week were affected versions (57.2K). ### [CVE-2025-4643](https://cve.now/CVE-2025-4643): Lack of JWT Expiration after Log Out in PayloadCMS - Severity: Medium 6.3 - Published: Aug 29, 2025 - Affected: fixed in 3.44.0. - Fixed in 3.44.0. - The latest release, 3.93.0, is not affected. - 3.5% of payload downloads last week were affected versions (57.2K). ### [CVE-2023-30843](https://cve.now/CVE-2023-30843): Payload's hidden fields can be leaked on readable collections - Severity: High 7.4 - Published: Apr 26, 2023 - Affected: fixed in 1.7.0. - Fixed in 1.7.0. - The latest release, 3.93.0, is not affected. - 0.6% of payload downloads last week were affected versions (9.1K). ### [CVE-2022-27952](https://cve.now/CVE-2022-27952): An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a… - Severity: Unrated - Published: Apr 12, 2022 - Affected: fixed in 0.15.1. - Fixed in 0.15.1. - The latest release, 3.93.0, is not affected. - 0.3% of payload downloads last week were affected versions (5.6K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/payload Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.