# Payload v3.88.0

- Product: Payload (https://whatsnew.fyi/product/payload-cms)
- Vendor: Payload
- Date: 2026-08-11
- Version: v3.88.0
- Original notes: https://github.com/payloadcms/payload/releases/tag/v3.88.0
- Permalink: https://whatsnew.fyi/product/payload-cms/releases/v3.88.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Prevent multipart content-type backtracking
- **fixed** — Tighten clipboard prefix matching to prevent sibling row leakage on copy/paste in UI
- **changed** — Improve access control defaults for API keys collection in plugin-mcp
- **changed** — Bump Next.js to 16.3.0 in templates

##### [v3.88.0](https://github.com/payloadcms/payload/compare/v3.87.1...v3.88.0) (2026-08-11)


###### 🐛 Bug Fixes

* prevent multipart content-type backtracking ([#17679](https://github.com/payloadcms/payload/issues/17679)) ([a742140](https://github.com/payloadcms/payload/commit/a742140))
* **ui:** tighten clipboard prefix matching to prevent sibling row leakage on copy/paste ([#17595](https://github.com/payloadcms/payload/issues/17595)) ([c6477b8](https://github.com/payloadcms/payload/commit/c6477b8))

###### 🛠 Refactors

* **plugin-mcp:** better access control defaults for api keys collection ([#17751](https://github.com/payloadcms/payload/issues/17751)) ([025581d](https://github.com/payloadcms/payload/commit/025581d))

###### 📝 Templates

* bump next.js to 16.3.0 ([#17683](https://github.com/payloadcms/payload/issues/17683)) ([ee155b7](https://github.com/payloadcms/payload/commit/ee155b7))

###### 🤝 Contributors

- Jarrod Flesch (@JarrodMFlesch)
- Alessio Gravili (@AlessioGr)
- Nate Lentz (@nathanlentz)