CVE-2026-105854
Received Received - Intake

Denial of Service in Payload CMS

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: GitHub, Inc.

Description
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource consumption. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-105854
EUVD
EUVD-2026-93498

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
payloadcms payload >= 3.0.0, < 3.90.0
payloadcms payload >= 4.0.0-canary.0, < 4.0.0-canary.34

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Payload, a headless content management system. A malformed multipart request body can cause the system to spend excessive time processing it, leading to uncontrolled resource consumption. It impacts versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34.

Detection Guidance

Detecting this vulnerability requires monitoring for unusually slow or resource-intensive multipart request processing in Payload CMS versions before 3.90.0 or 4.0.0-canary.34. Check server logs for requests with malformed multipart bodies causing delays. Use network monitoring tools to identify abnormal traffic patterns targeting Payload CMS endpoints.

Impact Analysis

This vulnerability can cause denial of service by consuming excessive server resources, potentially making the system unresponsive or crashing it. It may also slow down legitimate requests and degrade overall performance.

Compliance Impact

The vulnerability causes uncontrolled resource consumption due to malformed multipart requests, which could lead to denial-of-service conditions. This may impact compliance by disrupting availability of systems handling sensitive data, potentially violating GDPR's availability principle or HIPAA's access requirements.

Mitigation Strategies

Immediately upgrade Payload CMS to version 3.90.0 or 4.0.0-canary.34 or later. If upgrading is not possible, implement rate limiting or WAF rules to block malformed multipart requests. Monitor server resources closely for signs of resource exhaustion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105854. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart