GHSA-8r29-2mp2-pmrw: Npm/@payloadcms/plugin-ecommerce vulnerability
Impact When using the Stripe payment adapter, an order confirmation could be processed more than once under certain conditions.
You are affected if: - You use @payloadcms/plugin-ecommerce with the Stripe payment adapter.
Deployments that do not use the Stripe payment flow are not affected.
Patches Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds Ensure Stripe order confirmations can only be processed once. This is a temporary mitigation; upgrading to a patched version is recommended.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@payloadcms/plugin-ecommerceto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34 - Upgrade
Upgrade
npm/@payloadcms/plugin-ecommerceto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
@payloadcms/plugin-ecommerceto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
@payloadcms/plugin-ecommerceto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34 - Compensating control
Ensure Stripe order confirmations can only be processed once.
Event History
Frequently Asked Questions
Which deployments are affected?
Only deployments using @payloadcms/plugin-ecommerce with the Stripe payment adapter are affected. Deployments that do not use the Stripe payment flow are not affected.
What should we do if we cannot upgrade immediately?
Temporarily ensure that Stripe order confirmations can be processed only once. This is a mitigation; upgrading to a patched version remains recommended.
Which versions contain the fix?
Upgrade Payload packages to version 3.90.0 or later, or to 4.0.0-canary.34 or later.