~ / search / GHSA-97rh-rhh2-7vjv

GHSA-97rh-rhh2-7vjv

Payload: Remote Code Execution through first-register

Source: GitHub Advisory Database (reviewed) High CVE-2026-105858

Packages

EcosystemPackageAffectedFixed in
npm payload < 3.90.0 3.90.0
npm payload >= 4.0.0-canary.0, < 4.0.0-canary.34 4.0.0-canary.34

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A crafted request to the public first-register operation can be used to perform a RCE exploit. **You are affected if:** - You use local auth strategy and your application remains without an initial user created ## Patches In the patched version data submission to create first user is properly sanitized. Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.

References

External links from the advisory. They lead to third-party sites.