Is payload affected by CVE-2026-105863?

npm payload is affected in >= 3.0.0 = 4.0.0-canary.0 < 4.0.0-canary.34.

Is CVE-2026-105863 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.4%.

Not on the CISA KEV list. EPSS exploit probability is 0.4%.

Payload authentication token field handling issue

Under certain field configurations, Payload could include unintended values in the authentication token issued at login.

You are affected if:

You use an affected Payload version and have configured a custom field option that maps a field to a reserved authentication claim name.

Payload now restricts which field configuration options can influence the contents of the authentication token.

Users should upgrade payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

There is no complete workaround. Users should upgrade payload packages to >= 3.90.0 or >= 4.0.0-canary.34.