CVE-2026-34209

HighCVSS 7.5

Published: 31/03/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

mppx prior to version 0.4.11 contains a vulnerability in the tempo/session cooperative close handler. The close voucher amount validation uses "<" instead of "<=" against the on-chain settled amount. An attacker can submit a close voucher exactly equal to the settled amount, which is accepted without committing new funds, effectively closing the channel for free.

Risk Assessment

An attacker could close a payment channel without cost, leading to loss of funds or disruption.

Recommendation

Update mppx to version 0.4.11 or later.

Other vulnerabilities in mppx

CVE-2026-34210High
mppx before version 0.4.11 did not check Stripe's Idempotent-Replayed response header when creating PaymentIntents. An attacker could replay a valid credential with the same spt token against a new challenge, and the server would accept the replayed PaymentIntent as a new payment without actually charging the customer. This allowed paying once and consuming unlimited resources.

Original NVD description (English source)

mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using "<" instead of "<=" against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free. This issue has been patched in version 0.4.11.