Payload CMS v3.88.0 Is Out — Here’s What Changed
Payload CMS shipped v3.88.0 on August 11, 2026, bringing a targeted but important set of fixes and improvements. If you’re running Payload in production, this update is worth applying — especially for the security-related bug fix.
Security Fix: Multipart Content-Type Backtracking Prevented
The most notable change in this release is a fix that prevents multipart content-type backtracking. This closes a potential attack vector where malformed or crafted multipart requests could exploit content-type parsing behavior. If your Payload app accepts file uploads or multipart form data, updating to v3.88.0 is strongly recommended.
UI Fix: Clipboard Copy/Paste Row Leakage Resolved
A subtle but frustrating UI bug has been squashed: clipboard prefix matching has been tightened to prevent sibling row leakage during copy/paste operations in array and block fields. Previously, copying a row could inadvertently affect adjacent rows — this is now fixed.
MCP Plugin: Better Access Control Defaults for API Keys
The plugin-mcp has been refactored to ship with better access control defaults for the API keys collection. This means out-of-the-box security posture for MCP-powered Payload apps is now more sensible without requiring manual configuration.
Templates: Bumped to Next.js 16.3.0
All official Payload starter templates have been updated to use Next.js 16.3.0, aligning them with the latest Next.js release that brought instant navigations, 90% less dev memory usage, and 5.5x faster builds. New projects scaffolded with create-payload-app will now start on Next.js 16.3 by default.
How to Update
To upgrade to v3.88.0, run:
npm install payload@latestCheck the full release notes on GitHub for the complete changelog.
Key Takeaway: v3.88.0 is a focused patch release with a meaningful security fix for multipart handling, a UI clipboard bug fix, improved MCP plugin defaults, and Next.js 16.3 template alignment. Small release, but worth the update.
Hashtags: #PayloadCMS #NextJS #WebDevelopment #CMS #OpenSource #JavaScript #TypeScript #Security
Resources: