GHSA-2g7p-5934-q4w7: Npm/payload vulnerability

Q: What must an attacker be able to do to exploit this issue?

An attacker needs to be able to send a malformed multipart request body to the affected Payload application.

Q: What is the practical impact of a successful attack?

Processing the malformed multipart request can take an extremely long time to finish, potentially tying up application resources handling the request.

Q: Which package versions contain the fix?

Upgrade the npm Payload package to version 3.90.0 or later, or to 4.0.0-canary.34 or later.

Published Oct 6, 2026

Updated

Impact A malformed multipart request body could take an extremely long time to finish.

Patches Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Affected Software

2 affected componentsFixes available

npm/payload>=4.0.0-canary.0<4.0.0-canary.34

4.0.0-canary.34

npm/payload>=3.0.0<3.90.0

3.90.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/payload to a version that resolves this vulnerability.
Fixed in 4.0.0-canary.34
Upgrade
Upgrade npm/payload to a version that resolves this vulnerability.
Fixed in 3.90.0
Upgrade
Upgrade Payload packages to a version that resolves this vulnerability.
Fixed in 3.90.0
Upgrade
Upgrade Payload packages to a version that resolves this vulnerability.
Fixed in 4.0.0-canary.34

Event History

Oct 6, 2026

Advisory Published

via GitHub·04:18 PM

Data Sourced

via GitHub·04:18 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

An attacker needs to be able to send a malformed multipart request body to the affected Payload application.

What is the practical impact of a successful attack?