GitHub Advisoryadvisory · npm

GHSA-2g7p-5934-q4w7 Payload: ReDoS in Multipart Content-Type Validation

HIGH Published 2026-10-06 Modified 2026-10-06 Official page ↗
Aliases
CVE-2026-105854
Ecosystem
npm
Packages
payload
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-1333, CWE-400
Reviewed
2026-10-06

Affected packages

• npm payload: >= 3.0.0, < 3.90.0 → fixed in 3.90.0 • npm payload: >= 4.0.0-canary.0, < 4.0.0-canary.34 → fixed in 4.0.0-canary.34

Description

Impact A malformed multipart request body could take an extremely long time to finish. Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.

Related

Alias · CVE (1)

  • CVE-2026-105854 Payload is a free and open source headless content management system. vulnerability

Weakness · CWE (2)

  • CWE-1333 Inefficient Regular Expression Complexity weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References