Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@payloadcms/storage-vercel-blob

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3npmAmendedPublished

    @payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter

    CVE-2026-93363 · GHSA-mc8m-rr6c-r5qr

    Affected
    • npm @payloadcms/storage-vercel-blob >= 3.25.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34
    Fixed in
    4.0.0-canary.343.90.0· Vendor fix available
    Issue
    Impact In affected configurations, client upload access does not consistently align with the associated collection’s access configuration. You are affected if: - You use client uploads with `@payloadcms/storage-vercel-blob`. - Authenticated users can access the client-upload route. Applications that do not enable client uploads are not affected. Patches Client uploads now require authentication and the appropriate collection-level access before upload access is granted. Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. Workarounds Upgrading to a patched version is recommended. Until you can upgrade, disable client uploads or configure the upload route’s access control to enforce the associated collection’s permissions.

    Recommended action: Upgrade to 4.0.0-canary.34 (pre-release) or 3.90.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →