| Package | Affected versions | Patched versions |
|---|---|---|
| payload | = 4.0.0< 3.90.0 | 3.90.0 |
| @payloadcms/plugin-ecommerce | ≥ 4.0.0-canary.0, < 4.0.0-canary.34< 3.90.0 | 4.0.0-canary.343.90.0 |
When using the Stripe payment adapter, an order confirmation could be processed more than once under certain conditions.
You are affected if:
@payloadcms/plugin-ecommerce with the Stripe payment adapter.Deployments that do not use the Stripe payment flow are not affected.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Ensure Stripe order confirmations can only be processed once. This is a temporary mitigation; upgrading to a patched version is recommended.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free