CVE-2026-105863
Payload authentication token field handling issue
Under certain field configurations, Payload could include unintended values in the authentication token issued at login.
- No known exploitation
- Severity
- Critical, CVSS 9.2 (v4.0)
- EPSS
- 0.38% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- payload (npm) >= 3.0.0, < 3.90.0, fixed in 3.90.0 · GHSA-66wr-7vmr-p5jq
- payload (npm) >= 4.0.0-canary.0, < 4.0.0-canary.34, fixed in 4.0.0-canary.34 · GHSA-66wr-7vmr-p5jq