Payload CMS: Denial of service via malformed multipart requests
Summary
Payload is an open source headless content management system for Node.js. Versions from 3.0.0 before 3.90.0 and 4.0.0-canary.0 before 4.0.0-canary.34 process malformed multipart Content-Type request bodies so slowly that resources are consumed without limit. An unauthenticated remote attacker can send such requests to make the Payload instance unresponsive, which takes the affected website or admin backend offline. No confidentiality or integrity impact is documented.
Affected
- Payload (npm package payload) >= 3.0.0 and < 3.90.0
- Payload canary >= 4.0.0-canary.0 and < 4.0.0-canary.34
Fixed in
- Payload 3.90.0
- Payload 4.0.0-canary.34
Workaround
Unknown. The vendor documents no workaround; upgrading is the fix. A reverse proxy or CDN that enforces limits on body size, header size and request time may be used as interim hardening only, which is not vendor-confirmed and must be tested first.
Exploitation
- CISA KEV: not listed according to a third-party tracker; not verified on the CISA site.
- No evidence of exploitation in the wild found.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Upgrade Payload packages to 3.90.0 or 4.0.0-canary.34 and check the npm registry for newer 3.x releases before choosing a target.
- Check lockfiles and deployed builds, since Payload may be pulled in indirectly; a framework upgrade (for example Next.js) may be required.
- Patch internet-facing Payload instances first.
- Monitor request logs and response times for unusually long multipart processing.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-2g7p-5934-q4w7 (vendor) github.com
- GitHub Advisory Database GHSA-2g7p-5934-q4w7 github.com
- Payload release v3.90.0 github.com
- Payload fix commit 0084bd51 github.com
- OSV GHSA-2g7p-5934-q4w7 osv.dev
- GitLab Advisory Database CVE-2026-105854 advisories.gitlab.com
- CVE-2026-105854 analysis (third-party) cvereports.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:32.
Original description (NVD)
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource consumption. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.