Simplify your stack and build anything. Or everything.
Schedule a Demo
USE CASES
Headless CMSEnterprise App BuilderHeadless E-CommerceDigital Asset Management
FEATURES
Multi-TenancyWhite LabelLocalizationAccess ControlAuth
CASE STUDIES

See what others are building with Payload.

Browse Case Studies
Build tomorrow’s web with a modern solution you truly own.
PAYLOAD IS FOR
DevelopersMarketing teamsEnterprise companiesAgencies & Consultancies
COMPARE PAYLOAD
Payload vs WordPressPayload vs ContentfulPayload vs SanityPayload vs StrapiPayload vs Directus
AGENCY TESTIMONIAL

"Payload has transformed the way our clients manage content. It's an indispensable tool for any modern agency."

Become a PartnerFind a Partner
Code-based nature means you can build on top of it to power anything.
Resources
DocumentationExamplesTemplatesGitHubReleasesBlogGuides & Tutorials
Community
RoadmapDiscordCommunity Help
Resources for Developers

Get the resources you need to start building today

Guides & TutorialsExplore Docs
It’s time to take back your content infrastructure.
Schedule a Demo
Enterprise Features
SSOAI Auto-EmbeddingPublishing WorkflowsVisual EditorStatic A/B testingAI features
Customer Stories
MicrosoftASICSBlue OriginHello BelloTekton
Featured Customer Story

Microsoft chose Payload to tell the world about AI.

Read the case studyBrowse all
LoginGet Started
Author
Payload Logo Square SVG
Payload Team
@payloadcms

New in Payload: A Dependency Security Fix and Safer Draft Publishing

Author
Payload Logo Square SVG
Payload Team
@payloadcms
New in Payload: Release v3.86.0
New in Payload: Release v3.86.0

Payload 3.86.0 patches a high-severity security vulnerability and ships a round of fixes across drafts, bulk updates, database queries, and the admin UI.

Highlights

At the center of this release is a fix for CVE-2026-46625: we've overridden the js-cookie dependency to v3.0.7 and applied additional audit fixes. Upgrading any projects on older versions of Payload is recommended.

Also in this release:

  • Drafts & publishing: reordering documents no longer unpublishes ones that have a newer draft, and re-uploading a draft file no longer unpublishes its document
  • Bulk updates: fixed array and block row IDs being regenerated during bulk updates
  • Database: MongoDB nested relationship queries now exclude duplicate IDs, and Drizzle unique-constraint validation errors preserve the failing sub-tables
  • Rich text: markdown import now preserves hard line breaks
  • UI: row fields respect admin.condition, relationship cells show titles correctly for draft-only documents, and polymorphic upload relations are preserved during bulk select
  • Tooling: the payload bin works with tsx on Node v23.5+, and type generation no longer hangs on storage-r2
  • Localization: corrected the Burmese locale (removed stray Malay strings)
  • Cloud storage: separated client and server utility exports

    As always, you can review the complete changelog on GitHub.