What is GHSA-q6mq-ch85-c8mm?

GHSA-q6mq-ch85-c8mm is a security advisory published by GitHub Security Advisories with Medium severity. Payload: Password hashes use insufficient PBKDF2 iterations

Which CVE IDs does GHSA-q6mq-ch85-c8mm cover?

GHSA-q6mq-ch85-c8mm covers the following CVE IDs: CVE-2026-105804. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-q6mq-ch85-c8mm?

GHSA-q6mq-ch85-c8mm affects 2 products, including: npm/payload:\u003e= 3.0.0, \u003c 3.90.0; npm/payload:\u003e= 4.0.0-canary.0, \u003c 4.0.0-canary.34.

GHSA-q6mq-ch85-c8mmMedium

Payload: Password hashes use insufficient PBKDF2 iterations

Vendor

GitHub Security Advisories

Published

October 6, 2026

Last Modified

October 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-105804 →

📋 Description

Impact

The password-hashing configuration used a lower work factor than what is recommended.

Patches

Payload now uses stronger password-hashing parameters and transparently upgrades older hashes following a successful login.

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Workarounds

Upgrading is recommended. Until you can upgrade, protect database copies and backups from unauthorized access and require strong, unique passwords.

🎯 Affected products2

npm/payload:>= 3.0.0, < 3.90.0
npm/payload:>= 4.0.0-canary.0, < 4.0.0-canary.34

🔗 References (4)

https://github.com/payloadcms/payload/security/advisories/GHSA-q6mq-ch85-c8mm
https://github.com/payloadcms/payload/commit/1bc76e540a10f3ec88340f40591a57dae7456d01
https://github.com/payloadcms/payload/releases/tag/v3.90.0
https://github.com/advisories/GHSA-q6mq-ch85-c8mm