payload

HighnpmCVE-2026-105862October 7, 2026

What to do

Update payload to 3.90.0 or later.

npm install payload@3.90.0

A cross-site scripting flaw affects the npm package payload. Affected versions: < 3.90.0. Fixed from version 3.90.0. CVSS score 8.7.

What the flaw allows: Code can run in visitors’ browsers.

Package: payload
Ecosystem: npm (JavaScript)
Class: Cross-site scripting
Affected versions: < 3.90.0
CVSS: 8.7
Published on: October 7, 2026

Sources

GitHub Security Advisory — GHSA-2pwp-2369-8fg3GitHub Security Advisories
NVD — CVE-2026-105862NVD

Entry built automatically from the cited security advisory, with no model rewriting. Acknowledged by the organisation or vendor, notified to an authority, or established by two independent sources.