npm / payload
payload
What changed in payload 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-20.
24 security
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initpayload 324 changes
Security 24
Payload authentication token field handling issue
Payload: Bypassed sanitization of user uploaded SVGs
Payload didn't enforce field-level password update restrictions
Payload external upload trust validation issue
Payload: Incomplete validation during the upload file lifecycle
Payload: Password hashes use insufficient PBKDF2 iterations
Payload: Polymorphic join queries could disclose hidden fields
Payload: ReDoS in Multipart Content-Type Validation
Payload relationship-query authorization bypass
Payload: Remote Code Execution through first-register
Payload: Token refresh and password reset responses may expose restricted user fields
Payload: Unauthenticated account-lockout denial of service
Payload: Unauthorized update to collection documents
Payload: Uploaded XML files could execute same-origin JavaScript
Payload vulnerable to API key disclosure through ordinary document reads
Payload: Sort queries could expose protected field information
Payload: SQL Injection in SQLite and Postgres
Payload: Untrusted redirect URL parameter exploit
Payload has a CSRF Protection Bypass in Authentication Flow
Payload has an SQL Injection via Query Handling
Payload has Authenticated SSRF via Upload Functionality
Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery
Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads
payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments)