Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
References
| Link | Resource |
|---|---|
| https://github.com/payloadcms/payload/commit/6c0c4dc9b4ce1ac87b03fbb5dd7356b8559cbc4e | Patch |
| https://github.com/payloadcms/payload/releases/tag/v3.90.0 | Patch Release Notes |
| https://github.com/payloadcms/payload/security/advisories/GHSA-8r29-2mp2-pmrw | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
15 Oct 2026, 00:12
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:* |
|
| References | () https://github.com/payloadcms/payload/commit/6c0c4dc9b4ce1ac87b03fbb5dd7356b8559cbc4e - Patch | |
| References | () https://github.com/payloadcms/payload/releases/tag/v3.90.0 - Patch, Release Notes | |
| References | () https://github.com/payloadcms/payload/security/advisories/GHSA-8r29-2mp2-pmrw - Vendor Advisory | |
| First Time |
Payloadcms payload
Payloadcms |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.2 |
06 Oct 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-06 17:17
Updated : 2026-10-15 00:12
NVD link : CVE-2026-105850
Mitre link : CVE-2026-105850
CVE.ORG link : CVE-2026-105850
JSON object : View
Products Affected
payloadcms
- payload
CWE
CWE-837
Improper Enforcement of a Single, Unique Action