VulertSecurity VulertSecurity

Vulnerability Database · npm · payload · Version

payload 3.89.0

3.89.0 is affected by 16 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 2 High 10 Medium 4 Low 0 Unrated 0

All payload versions & vulnerabilities → Source repository Search the database for this package →
Released 10 Sep 2026 Licence MIT Also known from other sources 15 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by the npm registry. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

payload 3.89.0 vulnerabilities

16 vulnerabilities cover payload 3.89.0. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-105859: Payload Package Allows Unauthorized Document Updates 9.8 critical 3.90.0 07 Oct 2026
CVE-2026-105863: Payload Package Authentication Token Field Handling Vulnerability 9.2 critical 3.90.0 07 Oct 2026
CVE-2026-105862: Payload Package SVG Upload Sanitization Bypass Vulnerability 8.7 high 3.90.0 07 Oct 2026
CVE-2026-105854: Payload Package Suffers from ReDoS Vulnerability in Multipart Content-Type Validation 8.7 high 3.90.0 06 Oct 2026
CVE-2026-105868: Payload Package Vulnerability Allows Execution of Same-Origin JavaScript from Uploaded XML Files 8.6 high 3.90.0 07 Oct 2026
CVE-2026-105858: Payload Remote Code Execution via First-Register Operation 8.1 high 3.90.0 07 Oct 2026
CVE-2026-105865: Payload Package Vulnerability Leading to File Cleanup Issues 8.1 high 3.90.0 07 Oct 2026
CVE-2026-105849: Payload API Key Disclosure Vulnerability 7.7 high 3.90.0 06 Oct 2026
CVE-2026-105855: Payload Package Field-Level Password Update Restriction Bypass 7.6 high 3.90.0 06 Oct 2026
CVE-2026-105861: Payload Package External Upload Trust Validation Issue 7.2 high 3.90.0 07 Oct 2026
CVE-2026-105853: Payload Token Refresh and Password Reset Responses Expose Restricted User Fields 7.1 high 3.90.0 06 Oct 2026
CVE-2026-105847: Payload Package Vulnerability Exposes Hidden Fields via Polymorphic Join Queries 7.1 high 3.90.0 06 Oct 2026
CVE-2026-105866: Payload Unauthenticated Account-Lockout Denial of Service Vulnerability 6.9 medium 3.90.0 07 Oct 2026
CVE-2026-105852: Payload Package Authorization Bypass Vulnerability 6.9 medium 3.90.0 06 Oct 2026
CVE-2026-105804: Payload Package Suffers from Insufficient PBKDF2 Iterations Vulnerability 5.7 medium 3.90.0 06 Oct 2026
Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts 5.3 medium No fix published 26 Jun 2026

Looking for another version, or everything Vulert holds for payload?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About payload 3.89.0

Is payload 3.89.0 vulnerable?

Yes. 16 vulnerabilities in the Vulert database cover payload 3.89.0: 2 critical, 10 high, 4 medium and 0 low. Each entry above names the fixed version to move to.

Is 3.89.0 the latest release of payload?

No. 3.89.0 was published 10 Sep 2026, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor payload for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the payload version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.