CVE-2026-105854

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource consumption. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105854

EUVD

EUVD-2026-93498

Affected Vendors & Products

Vendor	Product	Version / Range
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	From 3.0.0 (inc) to 3.90.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects Payload, a headless content management system. A malformed multipart request body can cause the system to spend excessive time processing it, leading to uncontrolled resource consumption. It impacts versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34.

Detection Guidance

Detecting this vulnerability requires monitoring for unusually slow or resource-intensive multipart request processing in Payload CMS versions before 3.90.0 or 4.0.0-canary.34. Check server logs for requests with malformed multipart bodies causing delays. Use network monitoring tools to identify abnormal traffic patterns targeting Payload CMS endpoints.

Impact Analysis

This vulnerability can cause denial of service by consuming excessive server resources, potentially making the system unresponsive or crashing it. It may also slow down legitimate requests and degrade overall performance.

Compliance Impact

The vulnerability causes uncontrolled resource consumption due to malformed multipart requests, which could lead to denial-of-service conditions. This may impact compliance by disrupting availability of systems handling sensitive data, potentially violating GDPR's availability principle or HIPAA's access requirements.

Mitigation Strategies

Immediately upgrade Payload CMS to version 3.90.0 or 4.0.0-canary.34 or later. If upgrading is not possible, implement rate limiting or WAF rules to block malformed multipart requests. Monitor server resources closely for signs of resource exhaustion.

Hi! I’m here to help you understand CVE-2026-105854. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70