Payload: Password hashes use insufficient PBKDF2 iterations

中 5.7CVE-2026-105804 · GHSA-q6mq-ch85-c8mm · 06/10/2026 公開 · 06/10/2026 更新

要点

CVE-2026-105804 は payload に影響する深刻度「中」 (CVSS 5.7) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.08%（全脆弱性の 0.15% より高い）。
対処：3.90.0, 4.0.0-canary.34 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
payload npm	`≥ 3.0.0, < 3.90.0≥ 4.0.0-canary.0, < 4.0.0-canary.34`	`3.90.04.0.0-canary.34`

概要

Impact

The password-hashing configuration used a lower work factor than what is recommended.

Patches

Payload now uses stronger password-hashing parameters and transparently upgrades older hashes following a successful login.

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Workarounds

Upgrading is recommended. Until you can upgrade, protect database copies and backups from unauthorized access and require strong, unique passwords.

NVD の説明

Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 use a lower-than-recommended PBKDF2 work factor for password hashing, reducing the computational effort required to test recovered password hashes. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.