Payload CMS Releases Critical Security Update for 3.x and 4.0 — Update Now

Payload CMS Issues Urgent Security Patch — Versions 3.90.0 and 4.0.0-canary.34 Now Available

Payload CMS has released critical security updates for both its stable 3.x branch and the 4.0 canary track. If you’re running any version of Payload, the team is urging developers to update as soon as possible.

What Was Released

On September 18, 2026, the Payload team shipped:

  • Payload 3.90.0 — Stable release addressing multiple vulnerabilities in the 3.x branch
  • Payload 4.0.0-canary.34 — Canary release with the same security fixes for those testing the upcoming 4.0

What’s Fixed

The Payload team has published detailed security advisories on GitHub alongside the patched releases. Each advisory includes:

  • Affected versions
  • Severity ratings
  • Impact descriptions
  • Upgrade guidance

Breaking Changes — Migration Required

Both releases include several necessary breaking changes. Before updating, review the full migration steps in the v3.90.0 release notes on GitHub. The 4.0.0-canary.34 breaking changes and migration steps are identical to those in 3.90.0.

The Changing Security Landscape for Open Source

In their announcement, the Payload team addressed the evolving threat model for open-source projects in the age of AI-assisted vulnerability discovery:

“Models are getting significantly better at reading code and finding vulnerabilities in it, and OSS naturally sits on the leading edge of that shift. The code is public, so anyone can point these tools at it.”

The team noted they regularly red-team their own codebase, including reviewing pull requests as they’re opened and merged, to catch issues before they ship.

How to Update

To update to the latest secure version, run:

npm install payload@3.90.0
# or for canary users:
npm install payload@4.0.0-canary.34

Reporting Security Issues

If you discover a security vulnerability in Payload, the team asks that you report it responsibly by contacting them directly at security@payloadcms.com. If you run into problems upgrading, open a GitHub issue or reach out on Discord.

Key Takeaway: This is a security-critical update. All Payload 3.x users should upgrade to 3.90.0 immediately. Review the migration guide carefully before updating, as breaking changes are included.

Hashtags: #PayloadCMS #WebSecurity #NextJS #OpenSource #CMS #WebDevelopment #SecurityUpdate #JavaScript

Sources & Resources:

Search

Categories

Archives