Read the docs
TI-2026-26504 Aliases CVE-2026-34209GHSA-mv9j-8jvg-j8mr

mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality

Priority LOW 39CWE-294Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-294.

Summary

mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using "<" instead of "<=" against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free. This issue has been patched in version 0.4.11.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00373 31st percentileScored 2026-11-07
Fix Fixed mppx (wevm): 0.4.11mppx (npm): 0.4.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wevmmppxbefore 0.4.110.4.11Patch availableCNA
—mppx (npm)before 0.4.110.4.11Patch availableGHSA-mv9j-8jvg-j8mr
  • mppx Vendorwevm Affected before 0.4.11 Fixed in 0.4.11 Patch available CNA
  • mppx (npm) Vendor— Affected before 0.4.11 Fixed in 0.4.11 Patch available GHSA-mv9j-8jvg-j8mr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wevm:mppx:*:*:*:*:*:node.js:*:*before 0.4.11Vulnerablewevm
  • cpe:2.3:a:wevm:mppx:*:*:*:*:*:node.js:*:* Versions before 0.4.11 Vulnerable ·wevm

Remediation

  • Fix · CNA mppx (wevm) Fixed in 0.4.11
  • Fix · GHSA-mv9j-8jvg-j8mr mppx (npm) Fixed in 0.4.11 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34209
  2. 2026-10-03 Alias added: GHSA-mv9j-8jvg-j8mr

References

Patch 2

Advisory 1

Other 2

  • TI-2026-26505 mppx has Stripe charge credential replay via missing idempotency check CVSS 4.0MEDIUM 6.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences