| Package | Affected versions | Patched versions |
|---|---|---|
| payload | ≥ 3.0.0, < 3.90.0≥ 4.0.0-canary.0, < 4.0.0-canary.34 | 3.90.04.0.0-canary.34 |
The password-hashing configuration used a lower work factor than what is recommended.
Payload now uses stronger password-hashing parameters and transparently upgrades older hashes following a successful login.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Upgrading is recommended. Until you can upgrade, protect database copies and backups from unauthorized access and require strong, unique passwords.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free