What is GHSA-2g7p-5934-q4w7?

GHSA-2g7p-5934-q4w7 is a security advisory published by GitHub Security Advisories with High severity. Payload: ReDoS in Multipart Content-Type Validation

Which CVE IDs does GHSA-2g7p-5934-q4w7 cover?

GHSA-2g7p-5934-q4w7 covers the following CVE IDs: CVE-2026-105854. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-2g7p-5934-q4w7?

GHSA-2g7p-5934-q4w7 affects 2 products, including: npm/payload:\u003e= 3.0.0, \u003c 3.90.0; npm/payload:\u003e= 4.0.0-canary.0, \u003c 4.0.0-canary.34.

GHSA-2g7p-5934-q4w7High

Payload: ReDoS in Multipart Content-Type Validation

Vendor

GitHub Security Advisories

Published

October 6, 2026

Last Modified

October 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-105854 →

📋 Description

Impact

A malformed multipart request body could take an extremely long time to finish.

Patches

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

🎯 Affected products2

npm/payload:>= 3.0.0, < 3.90.0
npm/payload:>= 4.0.0-canary.0, < 4.0.0-canary.34

🔗 References (4)

https://github.com/payloadcms/payload/security/advisories/GHSA-2g7p-5934-q4w7
https://github.com/payloadcms/payload/commit/0084bd51fb7742b26a88431bb84cb1696857e6dc
https://github.com/payloadcms/payload/releases/tag/v3.90.0
https://github.com/advisories/GHSA-2g7p-5934-q4w7