CVE-2026-105854: Payload CMS DOS Vulnerability

CVE-2026-105854 Overview

Payload is a free and open source headless content management system (CMS) built on Node.js. CVE-2026-105854 affects Payload versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34. A malformed multipart request body causes Content-Type processing to take an extremely long time, leading to uncontrolled resource consumption [CWE-400]. Remote, unauthenticated attackers can exploit this flaw over the network without user interaction, degrading application availability. The maintainers released fixes in versions 3.90.0 and 4.0.0-canary.34.

Critical Impact
Unauthenticated attackers can send malformed multipart requests to exhaust server resources and cause denial of service against Payload CMS deployments.

Affected Products

Payload CMS versions 3.0.0 through 3.89.x
Payload CMS canary versions prior to 4.0.0-canary.34
Node.js applications embedding the affected payload npm package

Discovery Timeline

2026-10-06 - CVE CVE-2026-105854 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105854

Vulnerability Analysis

The vulnerability resides in Payload's multipart request handling pipeline. When the server parses a malformed multipart body, the Content-Type processing path performs work that scales poorly with crafted inputs. A single malicious HTTP request can occupy CPU and memory for extended periods, blocking the event loop and starving concurrent requests.

Payload exposes multipart handling through its upload APIs, so any endpoint accepting file uploads is reachable from the network. Because the issue manifests during parsing, authentication checks that run after body processing do not mitigate the condition. Repeated or parallel malformed requests amplify the impact and can take an application offline.

Root Cause

The root cause is unbounded work performed during multipart parsing combined with an upload limit flag that previously defaulted to permissive behavior. The patch sets abortOnLimit to default true so the server returns an HTTP 413 when a file exceeds configured size, rather than continuing to buffer. The parser's data and cleanup handlers were also updated to support asynchronous flow control, enabling backpressure during ingestion.

Attack Vector

Exploitation requires only network access to a Payload endpoint that accepts multipart data. An attacker crafts an HTTP request with a malformed multipart body and Content-Type header. The server consumes CPU parsing the request, blocking legitimate traffic.

typescript

   /**
    * Returns a HTTP 413 when the file is bigger than the size limit if `true`.
    * Otherwise, it will add a `truncated = true` to the resulting file structure.
-   * @default false
+   * @default true
    */
   abortOnLimit?: boolean | undefined
   /**

Source: payloadcms/payload commit 0084bd5 - the patch changes the default behavior of abortOnLimit in packages/payload/src/config/types.ts so oversized uploads are terminated with HTTP 413.

typescript

   fieldname: string,
   filename: string,
 ) => {
-  cleanup: () => void
+  cleanup: () => Promise<void> | void
   complete: () => Buffer
-  dataHandler: (data: Buffer) => void
+  dataHandler: (data: Buffer) => Promise<void> | void
   getFilePath: () => string
   getFileSize: () => number
   getHash: () => string

Source: payloadcms/payload commit 0084bd5 - the patch in packages/payload/src/uploads/fetchAPI-multipart/handlers.ts converts cleanup and dataHandler to async-capable signatures, enabling bounded processing.

Detection Methods for CVE-2026-105854

Indicators of Compromise

Sustained high CPU utilization on Node.js processes hosting Payload CMS correlated with inbound multipart POST or PUT traffic.
HTTP requests with malformed Content-Type: multipart/form-data headers, missing boundaries, or truncated bodies in access logs.
Spikes in request latency, event-loop lag, or 5xx responses on upload endpoints.
Repeated multipart requests from the same source IP without corresponding successful upload responses.

Detection Strategies

Inspect application logs for parse errors, timeouts, or stuck requests originating from the multipart handler path.
Monitor web application firewall (WAF) and reverse proxy logs for malformed multipart boundaries and anomalous Content-Type values.
Baseline normal multipart request duration and alert on outliers that exceed expected processing time.

Monitoring Recommendations

Enable Node.js process metrics for CPU, memory, and event-loop lag on servers running Payload CMS.
Rate-limit upload endpoints at the reverse proxy or API gateway layer.
Forward Payload application logs and HTTP access logs to a centralized analytics pipeline for correlation and alerting.

How to Mitigate CVE-2026-105854

Immediate Actions Required

Upgrade Payload CMS to 3.90.0 or 4.0.0-canary.34 or later.
Audit all deployments and container images for pinned versions of the payload package in the vulnerable range.
Place a WAF or reverse proxy in front of upload endpoints to enforce request size limits and reject malformed multipart requests.

Patch Information

The fix is published in Payload release v3.90.0 and canary 4.0.0-canary.34. Technical details are documented in the GitHub Security Advisory GHSA-2g7p-5934-q4w7 and the fix commit 0084bd5. The patch defaults abortOnLimit to true and introduces async-capable dataHandler and cleanup signatures to bound multipart processing.

Workarounds

Restrict access to upload endpoints to authenticated users at the proxy layer where possible.
Enforce strict request body size limits and connection timeouts at the load balancer or ingress controller.
Block or rate-limit requests with malformed Content-Type: multipart/form-data headers using WAF rules.

bash

# Upgrade Payload CMS to a patched version
npm install payload@3.90.0

# Or for canary track
npm install payload@4.0.0-canary.34

# Verify installed version
npm ls payload