npm/payload CVE-2026-105861: high, EPSS 0.14%

Payload external upload trust validation issue

Action: Upgrade payload to 3.90.0 or later.

npm i payload@3.90.0

npm i payload@4.0.0-canary.34

Affected

Fixed versions

Sources

• osv: GHSA-pj5h-5q6c-3pfx
• https://github.com/payloadcms/payload/security/advisories/GHSA-pj5h-5q6c-3pfx
• https://nvd.nist.gov/vuln/detail/CVE-2026-105861
• https://github.com/payloadcms/payload/commit/ba5cf6ae20d27a2c15106cb37466419031f86e6d
• https://github.com/payloadcms/payload
• https://github.com/payloadcms/payload/releases/tag/v3.90.0

CVE-2026-105861 · published 2026-10-07T20:29:41Z · modified 2026-10-07T20:45:05.788975222Z · JSON