GHSA-q6mq-ch85-c8mm

Payload: Password hashes use insufficient PBKDF2 iterations

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-105804

Packages

Ecosystem	Package	Affected	Fixed in
npm	payload	>= 3.0.0, < 3.90.0	3.90.0
npm	payload	>= 4.0.0-canary.0, < 4.0.0-canary.34	4.0.0-canary.34

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The password-hashing configuration used a lower work factor than what is recommended. ### Patches Payload now uses stronger password-hashing parameters and transparently upgrades older hashes following a successful login. Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ### Workarounds Upgrading is recommended. Until you can upgrade, protect database copies and backups from unauthorized access and require strong, unique passwords.

References

External links from the advisory. They lead to third-party sites.

https://github.com/payloadcms/payload/security/advisories/GHSA-q6mq-ch85-c8mm web
https://github.com/payloadcms/payload/commit/1bc76e540a10f3ec88340f40591a57dae7456d01 web
https://github.com/payloadcms/payload package
https://github.com/payloadcms/payload/releases/tag/v3.90.0 web