CVE-2026-105854: Payload Package Suffers from ReDoS Vulnerability in Multipart Content-Type Validation
Summary
CVE-2026-105854: Payload: ReDoS in Multipart Content-Type Validation. Affects payload across 2 version ranges.
>= 3.0.0, < 3.90.0
>= 4.0.0-canary.0, < 4.0.0-canary.34
Fixed in 3.90.0 or 4.0.0-canary.34, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Payload package is a popular tool in the npm ecosystem, designed for managing and processing multipart requests in web applications. It provides developers with a streamlined way to handle file uploads and form submissions. However, it has been identified that certain versions of Payload are vulnerable to a Regular Expression Denial of Service (ReDoS) attack, which can severely impact application performance.
Vulnerability Detail
The vulnerability arises from the way Payload validates multipart content-type requests. A malformed multipart request body can trigger excessive backtracking in regular expressions, leading to prolonged processing times. This can result in denial of service, as legitimate requests may be delayed or dropped altogether. The vulnerability is classified under CWE-1333 and CWE-400, indicating its potential for causing significant disruption in service availability.
How To Fix
Latest published version: 3.92.0 as of 23 Oct 2026
npm install payload@3.92.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.90.03.90.0npm install payload@3.90.0 -
>= 4.0.0-canary.0, < 4.0.0-canary.344.0.0-canary.34npm install payload@4.0.0-canary.34
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation on the multipart request body to mitigate the risk of malformed requests. However, this is not a complete solution and upgrading is strongly recommended.
Conclusion
The identified vulnerability in the Payload package poses a significant risk to applications relying on multipart content-type processing. Users are strongly encouraged to upgrade to the patched versions to ensure the security and performance of their applications. Utilizing tools like Vulert can help in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for payload →
FAQ
A ReDoS (Regular Expression Denial of Service) attack exploits the way regular expressions are processed, causing the application to consume excessive resources and potentially crash.
Versions of Payload prior to 3.90.0 and 4.0.0-canary.34 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
The CVSS score for this vulnerability is 8.7, indicating a high severity level.
If you cannot upgrade immediately, implement input validation on multipart request bodies as a temporary workaround, but plan to upgrade as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for payload.
