GHSA-2g7p-5934-q4w7

ghsaUSosv

Payload: ReDoS in Multipart Content-Type Validation

view advisory published 2026-10-06Licence: CC-BY-4.0

## Impact A malformed multipart request body could take an extremely long time to finish. ## Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-105854US	high7.5	0.35% (29th)	—	2026-10-06
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request…

references

External citations — patches, advisories, analysis.

https://github.com/payloadcms/payloadPACKAGE
https://github.com/payloadcms/payload/commit/0084bd51fb7742b26a88431bb84cb1696857e6dcWEB
https://github.com/payloadcms/payload/releases/tag/v3.90.0WEB
https://github.com/payloadcms/payload/security/advisories/GHSA-2g7p-5934-q4w7WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan