GHSA-2g7p-5934-q4w7

Payload: ReDoS in Multipart Content-Type Validation

Source: GitHub Advisory Database (reviewed) High CVE-2026-105854

Packages

Ecosystem	Package	Affected	Fixed in
npm	payload	>= 3.0.0, < 3.90.0	3.90.0
npm	payload	>= 4.0.0-canary.0, < 4.0.0-canary.34	4.0.0-canary.34

Details

As written in the advisory (Markdown source, shown as plain text).

## Impact A malformed multipart request body could take an extremely long time to finish. ## Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.

References

External links from the advisory. They lead to third-party sites.

https://github.com/payloadcms/payload/security/advisories/GHSA-2g7p-5934-q4w7 web
https://github.com/payloadcms/payload/commit/0084bd51fb7742b26a88431bb84cb1696857e6dc web
https://github.com/payloadcms/payload package
https://github.com/payloadcms/payload/releases/tag/v3.90.0 web