Disclosure summary
### Impact Under certain conditions, sorting readable records could reveal limited information about fields the requester was not permitted to read. You are affected if untrusted users can query a collection, control its sorting, and sort by protected fields. ### Patches Payload now applies field-level access checks to sort fields before executing queries. Users should upgrade to `>= 3.88.0` or `>= 4.0.0-canary.27`. ### Workarounds Upgrading is recommended. Until then, prevent untrusted users from controlling sort parameters or restrict their access to affected collections.
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
GitHub Reviewed Security Advisories · GHSA-9g87-32v6-3c2r
Open original source · Updated Oct 06, 2026
Payload: Sort queries could expose protected field information
Source severity: MEDIUM / 6.9
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| npm | payload | < 3.88.0 | 3.88.0 |
| npm | payload | >= 4.0.0-canary.0, < 4.0.0-canary.27 | 4.0.0-canary.27 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Reviewed advisory
PUBLISHED 2026-10-06T11:38:32-04:00
MODIFIED 2026-10-06T11:38:33-04:00
INGESTED 2026-10-06T11:45:43-04:00