npm/@payloadcms/db-d1-sqlite CVE-2026-105856, CVE-2026-63316: high 8.3, EPSS 0.29%

Payload: SQL injection in SQLite/Postgres

Action: Upgrade @payloadcms/db-d1-sqlite to 3.90.0 or later.

npm i @payloadcms/db-d1-sqlite@3.90.0

npm i @payloadcms/db-d1-sqlite@4.0.0-canary.34

Affected

Fixed versions

Sources

• osv: GHSA-pj7x-6wpf-pgvp#npm/@payloadcms/db-d1-sqlite
• nvd: CVE-2026-105856
• https://github.com/payloadcms/payload/security/advisories/GHSA-pj7x-6wpf-pgvp
• https://github.com/payloadcms/payload/commit/03b78c7e0901d19c67f07bdf6396a276010adbcc
• https://github.com/payloadcms/payload
• https://github.com/payloadcms/payload/releases/tag/v3.90.0

CVE-2026-105856, CVE-2026-63316 · published 2026-10-07T20:30:04Z · modified 2026-10-14T02:55:56.435104575Z · JSON