Resource Consumption Issue in Payload CMS Versions
CVE-2026-105854
8.7HIGH
What is CVE-2026-105854?
A potential resource consumption issue has been identified in Payload CMS, versions 3.0.0 through 3.90.0 and earlier canary releases before 4.0.0-canary.34. Specifically, a malformed multipart request body can lead to excessive resource usage due to prolonged processing times of multipart Content-Type. This vulnerability has been addressed in the updates to version 3.90.0 and 4.0.0-canary.34, encouraging users to upgrade to mitigate these risks. For more details, refer to the security advisory and commits linked in the references.
Affected Version(s)
payload >= 3.0.0, < 3.90.0 < 3.0.0, 3.90.0
payload >= 4.0.0-canary.0, < 4.0.0-canary.34 < 4.0.0-canary.0, 4.0.0-canary.34