GitHub Advisoryadvisory · npm

GHSA-8r29-2mp2-pmrw Payload Ecommerce has an order confirmation validation issue

HIGH Published 2026-10-06 Modified 2026-10-06 Official page ↗
Aliases
CVE-2026-105850
Ecosystem
npm
Packages
@payloadcms/plugin-ecommerce
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-837
Reviewed
2026-10-06

Affected packages

• npm @payloadcms/plugin-ecommerce: < 3.90.0 → fixed in 3.90.0 • npm @payloadcms/plugin-ecommerce: >= 4.0.0-canary.0, < 4.0.0-canary.34 → fixed in 4.0.0-canary.34

Description

Impact When using the Stripe payment adapter, an order confirmation could be processed more than once under certain conditions. You are affected if: • You use `@payloadcms/plugin-ecommerce` with the Stripe payment adapter. Deployments that do not use the Stripe payment flow are not affected. Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. Workarounds Ensure Stripe order confirmations can only be processed once. This is a temporary mitigation; upgrading to a patched version is recommended.

Related

Alias · CVE (1)

  • CVE-2026-105850 Payload is a free and open source headless content management system. vulnerability

Weakness · CWE (1)

  • CWE-837 Improper Enforcement of a Single, Unique Action weakness

References