Summary
Payload: ReDoS in Multipart Content-Type Validation
Advisory details
Impact
A malformed multipart request body could take an extremely long time to finish.
Patches
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
References
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-104150
AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity
- HIGHCVE-2026-104861
probe-image-size: Quadratic-time Denial of Service in the SVG Parser
- HIGHCVE-2026-89407
jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()
- HIGHCVE-2026-87819
GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing
- HIGHCVE-2026-101906
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
- MEDIUMCVE-2026-86000
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns