CVE-2026-105850: Payload: Order confirmation validation issue in Payload Ecommerce
Impact When using the Stripe payment adapter, an order confirmation could be processed more than once under certain conditions.
You are affected if: - You use @payloadcms/plugin-ecommerce with the Stripe payment adapter.
Deployments that do not use the Stripe payment flow are not affected.
Patches Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds Ensure Stripe order confirmations can only be processed once. This is a temporary mitigation; upgrading to a patched version is recommended.
Other sources
Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@payloadcms/plugin-ecommerceto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34 - Upgrade
Upgrade
npm/@payloadcms/plugin-ecommerceto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
@payloadcms/plugin-ecommerceto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
@payloadcms/plugin-ecommerceto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34 - Compensating control
Ensure Stripe order confirmations can only be processed once when using the Stripe payment adapter.
Event History
Frequently Asked Questions
Which deployments are affected?
Only deployments using @payloadcms/plugin-ecommerce with the Stripe payment adapter are affected. Deployments that do not use the Stripe payment flow are not affected.
What could happen if the issue is exploited?
Under certain conditions, a Stripe order confirmation can be processed more than once. This can affect order-processing integrity and availability.
Which versions contain the fix?
Upgrade Payload packages to version 3.90.0 or later, or to 4.0.0-canary.34 or later for the canary release line.
What can be done before upgrading?
Ensure that Stripe order confirmations can be processed only once. This is a temporary mitigation, and upgrading to a patched version is recommended.