CVE-2026-105858: Payload Remote Code Execution via First-Register Operation
Summary
CVE-2026-105858: Payload: Remote Code Execution through first-register. Affects payload across 2 version ranges.
< 3.90.0
>= 4.0.0-canary.0, < 4.0.0-canary.34
Fixed in 3.90.0 or 4.0.0-canary.34, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Payload is an open-source framework designed for building applications with a focus on ease of use and flexibility. It provides a range of features including user authentication, data management, and customizable APIs. However, it has been found to contain a critical vulnerability that allows for remote code execution (RCE) when the first-register operation is improperly handled, particularly in environments lacking an initial user setup.
Vulnerability Detail
The vulnerability arises from a crafted request to the public first-register operation, which can be exploited to execute arbitrary code on the server. This issue is particularly concerning for applications using a local authentication strategy without an initial user created. Attackers can leverage this flaw to gain unauthorized access and potentially compromise the entire application, leading to severe security breaches.
How To Fix
Latest published version: 3.92.0 as of 23 Oct 2026
npm install payload@3.92.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.90.03.90.0npm install payload@3.90.0 -
>= 4.0.0-canary.0, < 4.0.0-canary.344.0.0-canary.34npm install payload@4.0.0-canary.34
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that your application has an initial user created before allowing access to the first-register operation. This can help prevent unauthorized exploitation until the package is updated.
Conclusion
In summary, CVE-2026-105858 represents a significant security risk for users of the Payload package, particularly those without an initial user setup. Immediate action is recommended to update to the patched versions to safeguard against potential remote code execution attacks.
See every vulnerability recorded for payload →
FAQ
CVE-2026-105858 is a vulnerability in the Payload package that allows remote code execution through the first-register operation.
Users of the Payload package who utilize a local authentication strategy without an initial user created are at risk.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
As a temporary measure, ensure that an initial user is created in your application to mitigate the risk of exploitation until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for payload.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
