# What changed in payload

> 24 changes in payload 3 from its official release notes, upgrade guides and advisories: 24 security. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/npm/payload/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## payload 3

### Security

- Payload authentication token field handling issue (3.90.0) — [security advisory](https://github.com/advisories/GHSA-66WR-7VMR-P5JQ)
- Payload: Bypassed sanitization of user uploaded SVGs (3.90.0) — [security advisory](https://github.com/advisories/GHSA-2PWP-2369-8FG3)
- Payload didn't enforce field-level password update restrictions (3.90.0) — [security advisory](https://github.com/advisories/GHSA-FX49-4H83-WJV9)
- Payload external upload trust validation issue (3.90.0) — [security advisory](https://github.com/advisories/GHSA-PJ5H-5Q6C-3PFX)
- Payload: Incomplete validation during the upload file lifecycle (3.90.0) — [security advisory](https://github.com/advisories/GHSA-P223-2WR2-J562)
- Payload: Password hashes use insufficient PBKDF2 iterations (3.90.0) — [security advisory](https://github.com/advisories/GHSA-Q6MQ-CH85-C8MM)
- Payload: Polymorphic join queries could disclose hidden fields (3.90.0) — [security advisory](https://github.com/advisories/GHSA-FPWW-C55P-CJV6)
- Payload: ReDoS in Multipart Content-Type Validation (3.90.0) — [security advisory](https://github.com/advisories/GHSA-2G7P-5934-Q4W7)
- Payload relationship-query authorization bypass (3.90.0) — [security advisory](https://github.com/advisories/GHSA-7C34-32V3-J575)
- Payload: Remote Code Execution through first-register (3.90.0) — [security advisory](https://github.com/advisories/GHSA-97RH-RHH2-7VJV)
- Payload: Token refresh and password reset responses may expose restricted user fields (3.90.0) — [security advisory](https://github.com/advisories/GHSA-XGV3-CRQ2-6F69)
- Payload: Unauthenticated account-lockout denial of service (3.90.0) — [security advisory](https://github.com/advisories/GHSA-V5GF-VPJC-PC7W)
- Payload: Unauthorized update to collection documents (3.90.0) — [security advisory](https://github.com/advisories/GHSA-F7HX-52Q9-HCRF)
- Payload: Uploaded XML files could execute same-origin JavaScript (3.90.0) — [security advisory](https://github.com/advisories/GHSA-9QPG-3CF8-W33X)
- Payload vulnerable to API key disclosure through ordinary document reads (3.90.0) — [security advisory](https://github.com/advisories/GHSA-238X-W2J9-GWWR)
- Payload: Sort queries could expose protected field information (3.88.0) — [security advisory](https://github.com/advisories/GHSA-9G87-32V6-3C2R)
- Payload: SQL Injection in SQLite and Postgres (3.88.0) — [security advisory](https://github.com/advisories/GHSA-V49J-62M6-PGRR)
- Payload: Untrusted redirect URL parameter exploit (3.88.0) — [security advisory](https://github.com/advisories/GHSA-W84C-53H3-MC2G)
- Payload has a CSRF Protection Bypass in Authentication Flow (3.79.1) — [security advisory](https://github.com/advisories/GHSA-P6MR-XF3R-GHQ4)
- Payload has an SQL Injection via Query Handling (3.79.1) — [security advisory](https://github.com/advisories/GHSA-7XXH-373W-35VG)
- Payload has Authenticated SSRF via Upload Functionality (3.79.1) — [security advisory](https://github.com/advisories/GHSA-6R7F-Q7F5-WPX8)
- Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery (3.79.1) — [security advisory](https://github.com/advisories/GHSA-HP5W-3HXX-VMWF)
- Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads (3.75.0) — [security advisory](https://github.com/advisories/GHSA-HHFX-5X8J-F5F6)
- payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments) (3.74.0) — [security advisory](https://github.com/advisories/GHSA-JQ29-R496-R955)