npm/payload CVE-2025-4644: medium, EPSS 0.41%

Payload's SQLite adapter Session Fixation vulnerability

Action: Upgrade payload to 3.44.0 or later.

npm i payload@3.44.0

Affected

Fixed versions

Sources

• osv: GHSA-26rv-h2hf-3fw4
• https://nvd.nist.gov/vuln/detail/CVE-2025-4644
• https://github.com/payloadcms/payload/commit/26d709dda6e512ce347557eaa2057db6e0cbf809
• https://cert.pl/en/posts/2025/08/CVE-2025-4643
• https://github.com/payloadcms/payload

CVE-2025-4644 · published 2025-08-29T12:31:11Z · modified 2025-08-29T18:14:35.893684Z · JSON