CVE-2026-63627
MediumCVSS 6.9Summary
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored calldata but did not reject trailing bytes. A client could append nonzero padding increasing intrinsic calldata gas while gas_limit and max_fee_per_gas stayed within policy caps, causing the server fee_payer wallet to pay substantially more than required. The tested 16 KB header limit bounded padding to ~5,500 bytes, producing ~5x normal fees. Fixed in 0.8.2.
Risk Assessment
An attacker can inflate server transaction costs, potentially leading to excessive spending and financial losses.
Recommendation
Upgrade mppx to version 0.8.2 or later.
Other vulnerabilities in mppx
See all- CVE-2026-63628Medium
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied access_list from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume intrinsic gas even when unused, a client could add fabricated address-only entries and cause the server fee_payer wallet to pay unnecessary transaction fees. The demonstrated 180-entry list stayed within gas and size limits while increasing fees ~9.4x. Fixed in 0.8.2.
- CVE-2026-34210High
mppx before version 0.4.11 did not check Stripe's Idempotent-Replayed response header when creating PaymentIntents. An attacker could replay a valid credential with the same spt token against a new challenge, and the server would accept the replayed PaymentIntent as a new payment without actually charging the customer. This allowed paying once and consuming unlimited resources.
- CVE-2026-34209High
mppx prior to version 0.4.11 contains a vulnerability in the tempo/session cooperative close handler. The close voucher amount validation uses "<" instead of "<=" against the on-chain settled amount. An attacker can submit a close voucher exactly equal to the settled amount, which is accepted without committing new funds, effectively closing the channel for free.
Original NVD description (English source)
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored calldata but did not reject trailing bytes. A client could append nonzero padding that increased intrinsic calldata gas while gas_limit and max_fee_per_gas remained within policy caps, causing the server fee_payer wallet to pay substantially more than the decoded transaction required. The tested 16 KB header limit bounded the demonstrated padding to about 5,500 bytes and produced approximately five times the normal transaction fee. This issue is fixed in version 0.8.2.