Feed/CVE-2026-105804
CVE-2026-105804MEDIUMCVSS 0.0

Payload: Password hashes use insufficient PBKDF2 iterations

Published Oct 6, 2026·Updated Oct 6, 2026

NVD Description

### Impact The password-hashing configuration used a lower work factor than what is recommended. ### Patches Payload now uses stronger password-hashing parameters and transparently upgrades older hashes following a successful login. Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ### Workarounds Upgrading is recommended. Until you can upgrade, protect database copies and backups from unauthorized access and require strong, unique passwords.

Affected Packages (1)

payloadNPM
From 3.0.0
Fixed in 3.90.0

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Register your stack and get notified within minutes when a matching CVE drops.

Start monitoring free