CVE-2026-105850 is a High severity flaw in the Payload ecommerce plugin. In @payloadcms/plugin-ecommerce before 3.90.0, when the Stripe payment adapter is used, an order confirmation can be processed more than once under certain conditions. Upgrade to 3.90.0, or 4.0.0-canary.34 on canary.
What's affected
- Package: @payloadcms/plugin-ecommerce (npm).
- Affected: before 3.90.0, and canary versions before 4.0.0-canary.34.
- Fixed: 3.90.0 and 4.0.0-canary.34.
- Condition: the Stripe payment adapter is in use. The advisory says deployments that do not use the Stripe flow are not affected.
- Workaround from the advisory: ensure Stripe order confirmations can only be processed once, as a temporary mitigation.
The record scores this 8.2 (CVSS 3.1 vector) and calls it High. The project's GitHub advisory gives a score of 8.8 and a rating of High under CVSS v4. Both are listed here because different scoring systems rate the same flaw differently. Judge urgency by whether the described configuration matches yours.
How to check if you're exposed
Payload is an npm package, so read the installed version in each project and environment.
npm ls payload
pnpm why payload
grep -n "payload" package.json
Check every deployment target too: production, staging, preview builds and any container image built from an older commit. Then look at the packages next to Payload, because this release series also touches plugins and database adapters:
npm ls @payloadcms/plugin-ecommerce @payloadcms/plugin-multi-tenant
npm ls @payloadcms/db-postgres @payloadcms/db-sqlite @payloadcms/db-vercel-postgres @payloadcms/db-d1-sqlite
Then confirm whether the Stripe flow is active.
grep -rn "stripeAdapter\|plugin-ecommerce" src/
No match means the plugin is not configured. If it is, review how your order confirmation endpoint behaves when it is called a second time for the same payment, and look at past orders for duplicates, such as repeated stock decrements or repeated fulfilment events.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads a manifest or lockfile and shows which packages carry known CVEs, including this one. Nothing is installed and nothing leaves your browser session beyond the scan itself.
What to do now
- Upgrade all Payload packages together to 3.90.0 or later on the 3.x line, or to 4.0.0-canary.34 or later on the canary line, and keep versions in step across packages.
- Audit recent orders for duplicates: the same payment confirmed twice, repeated emails, or stock and fulfilment records that do not match payments.
- Add your own idempotency check keyed on the Stripe payment identifier, so a confirmation applies once even if called again.
- Review Stripe dashboard records against your orders for the period before the upgrade.
- Read the v3.90.0 release notes for behavior and API changes that may need code updates, and run your test suite before deploying.
- Redeploy every environment, including preview and staging, and rebuild container images.
- Re-scan your lockfile after the change to confirm no older copy of the package remains.
Why it matters
The record lists CWE-837, improper enforcement of a single, unique action. A payment confirmation should be an event that takes effect once. When the same confirmation can be processed again, the business logic that follows, such as marking an order paid, reducing stock or issuing a digital item, can run again too.
The advisory keeps the detail short: under certain conditions, a confirmation can be processed more than once. The scoring shows high integrity and availability impact and no privileges needed, which is why the rating is high. The practical risk is wrong orders and bad inventory, and in the worst case, goods delivered without matching payment.
The record does not list this CVE as exploited in the wild. Payment flows are a place where the standard defence is idempotency, so check that your own handlers have it, whatever the library does. Payload's release notes for v3.90.0 describe a set of critical security fixes and recommend upgrading even if none of the listed items affect you. They also say exploit details and severity are intentionally left out of the notes, so read each advisory for the conditions.
Quick check
Who is affected?
Only deployments using the Stripe payment adapter from the ecommerce plugin, according to the advisory.
Is there a temporary mitigation?
The advisory says to ensure Stripe order confirmations can only be processed once, and recommends upgrading as the real fix.
Sources
Last reviewed: 18 October 2026.
