CVE-2026-105854 is a High severity denial of service in Payload, the headless CMS. From 3.0.0 before 3.90.0, a malformed multipart request body can make Content-Type processing take an extremely long time, which exhausts resources. Upgrade to 3.90.0, or 4.0.0-canary.34 on canary.
What's affected
- Package: payload (npm).
- Affected: 3.0.0 before 3.90.0, and 4.0.0-canary.0 before 4.0.0-canary.34.
- Fixed: 3.90.0 and 4.0.0-canary.34.
- Condition: the server accepts multipart requests, which is how uploads and form posts arrive.
- Workarounds: the advisory lists none.
The record scores this 7.5 (CVSS 3.1 vector) and calls it High. The project's GitHub advisory gives a score of 8.7 and a rating of High under CVSS v4. Both are listed here because different scoring systems rate the same flaw differently. Judge urgency by whether the described configuration matches yours.
How to check if you're exposed
Payload is an npm package, so read the installed version in each project and environment.
npm ls payload
pnpm why payload
grep -n "payload" package.json
Check every deployment target too: production, staging, preview builds and any container image built from an older commit. Then look at the packages next to Payload, because this release series also touches plugins and database adapters:
npm ls @payloadcms/plugin-ecommerce @payloadcms/plugin-multi-tenant
npm ls @payloadcms/db-postgres @payloadcms/db-sqlite @payloadcms/db-vercel-postgres @payloadcms/db-d1-sqlite
Then consider your edge. A request that stalls the Node.js event loop blocks every other request on that process.
curl -s -o /dev/null -w "%{time_total}\n" https://your-site.example/api/health
Use a health endpoint like the one above to watch response time under normal load, so you can see a stall quickly if it happens. Then review whether your reverse proxy or CDN limits request size and header length before traffic reaches Payload.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads a manifest or lockfile and shows which packages carry known CVEs, including this one. Nothing is installed and nothing leaves your browser session beyond the scan itself.
What to do now
- Upgrade all Payload packages together to 3.90.0 or later on the 3.x line, or to 4.0.0-canary.34 or later on the canary line, and keep versions in step across packages.
- Put a reverse proxy or CDN in front of Payload that enforces limits on body size, header size and request time.
- Run more than one instance behind a load balancer, with health checks that remove an unresponsive node.
- Alert on sustained CPU use or event loop delay in the Node.js process.
- Read the v3.90.0 release notes for behavior and API changes that may need code updates, and run your test suite before deploying.
- Redeploy every environment, including preview and staging, and rebuild container images.
- Re-scan your lockfile after the change to confirm no older copy of the package remains.
Why it matters
The record lists CWE-1333, inefficient regular expression complexity, and CWE-400, uncontrolled resource consumption. This is ReDoS: a regular expression that backtracks badly on a crafted string can take a very long time to finish on input of modest size.
Node.js runs JavaScript on one main thread per process. While a bad expression is running, nothing else on that process is answered. A few malformed requests can therefore keep a site down, and the attacker needs no account because the check happens while the request is parsed.
The fix changes the Content-Type handling so it no longer takes pathological time. The record does not list this CVE as exploited in the wild. Edge limits help, but they cannot see inside a regular expression, so the upgrade is the real answer. Payload's release notes for v3.90.0 describe a set of critical security fixes and recommend upgrading even if none of the listed items affect you. They also say exploit details and severity are intentionally left out of the notes, so read each advisory for the conditions.
Quick check
Does the attacker need to log in?
The record shows no privileges required. The slow parsing happens as the multipart request is handled.
Can a proxy fully protect me?
It can limit size and time, which helps. It cannot replace the fix for the slow expression, so upgrade.
Sources
Last reviewed: 18 October 2026.
