Feed/CVE-2026-105850
CVE-2026-105850HIGHCVSS 0.0

Payload Ecommerce has an order confirmation validation issue

Published Oct 6, 2026·Updated Oct 6, 2026

NVD Description

## Impact When using the Stripe payment adapter, an order confirmation could be processed more than once under certain conditions. You are affected if: - You use `@payloadcms/plugin-ecommerce` with the Stripe payment adapter. Deployments that do not use the Stripe payment flow are not affected. ## Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ## Workarounds Ensure Stripe order confirmations can only be processed once. This is a temporary mitigation; upgrading to a patched version is recommended.

Affected Packages (1)

@payloadcms/plugin-ecommerceNPM
Fixed in 3.90.0

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Register your stack and get notified within minutes when a matching CVE drops.

Start monitoring free