npm / @payloadcms/db-mongodb

@payloadcms/db-mongodb

What changed in @payloadcms/db-mongodb 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-20.

15 security

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@payloadcms/db-mongodb 315 changes

Payload: Client uploads could overwrite S3 objects
3.90.0security advisory
Payload Ecommerce has an order confirmation validation issue
3.90.0security advisory
Payload Form Builder has an RCE issue
3.90.0security advisory
Payload has a tenant authorization bypass in Multi-Tenant Plugin
3.90.0security advisory
Payload: Insufficient Access Control in Stripe REST Proxy
3.90.0security advisory
@payloadcms/plugin-multi-tenant has a cross-tenant create issue
3.90.0security advisory
Payload: Improper access control for MCP API keys
3.88.0security advisory
Payload: Prototype pollution in Payload Import Export plugin
3.88.0security advisory
Payload: Untrusted redirect URL parameter exploit
3.88.0security advisory
Payload: Field-level write access bypass in Payload on MongoDB
3.87.0security advisory
Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery
3.79.1security advisory
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
3.78.0security advisory
@payloadcms/next has Stored XSS in Admin Panel
3.78.0security advisory
Payload: SQL injection in SQLite/Postgres
3.73.0security advisory
@payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
3.73.0security advisory