CVE-2026-105850: Payload Ecommerce has an order confirmation validation issue

October 6, 2026

When using the Stripe payment adapter, an order confirmation could be processed more than once under certain conditions.

You are affected if:

You use @payloadcms/plugin-ecommerce with the Stripe payment adapter.

Deployments that do not use the Stripe payment flow are not affected.

References

github.com/advisories/GHSA-8r29-2mp2-pmrw
github.com/payloadcms/payload/commit/6c0c4dc9b4ce1ac87b03fbb5dd7356b8559cbc4e
github.com/payloadcms/payload/releases/tag/v3.90.0
github.com/payloadcms/payload/security/advisories/GHSA-8r29-2mp2-pmrw
nvd.nist.gov/vuln/detail/CVE-2026-105850

Code Behaviors & Features

Detect and mitigate CVE-2026-105850 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →