Is payload affected by CVE-2026-105805?

npm payload is affected in = 4.0.0-canary.0 < 4.0.0-canary.27.

Is CVE-2026-105805 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.3%.

Not on the CISA KEV list. EPSS exploit probability is 0.3%.

Payload: Sort queries could expose protected field information

Under certain conditions, sorting readable records could reveal limited information about fields the requester was not permitted to read.

You are affected if untrusted users can query a collection, control its sorting, and sort by protected fields.

Payload now applies field-level access checks to sort fields before executing queries.

Users should upgrade to >= 3.88.0 or >= 4.0.0-canary.27.

Upgrading is recommended. Until then, prevent untrusted users from controlling sort parameters or restrict their access to affected collections.