Read the docs
TI-2026-66338 Aliases GHSA-qr2g-p6q7-w82m

x402 SDK Security Advisory

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

### Impact A security vulnerability exists in outdated versions of the x402 SDK. This vulnerability does not affect users' private keys, smart contracts, or funds. The issue impacts resource servers accepting payments on Solana when the facilitator is running a vulnerable version of the x402 SDK. ### Who Should Take Action Facilitators that process payments on Solana must upgrade the x402 SDK to the patched versions listed below. Clients are not required to upgrade. Resource servers are not required to upgrade unless they operate their own facilitator (self-facilitate). ### Patches Please update to the following package versions: * Npm: @x402/svm >= 2.6.0 * Pypi: x402 >= 2.3.0 * Go: x402 >= 2.5.0

Why it matters now

Fix Fixed @x402/svm (npm): 2.6.0x402 (PyPI): 2.3.0+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—@x402/svm (npm)before 2.6.02.6.0Patch availableGHSA-qr2g-p6q7-w82m
—x402 (PyPI)before 2.3.02.3.0Patch availableGHSA-qr2g-p6q7-w82m
—github.com/coinbase/x402/go (Go)before 2.5.02.5.0Patch availableGHSA-qr2g-p6q7-w82m
  • @x402/svm (npm) Vendor— Affected before 2.6.0 Fixed in 2.6.0 Patch available GHSA-qr2g-p6q7-w82m
  • x402 (PyPI) Vendor— Affected before 2.3.0 Fixed in 2.3.0 Patch available GHSA-qr2g-p6q7-w82m
  • github.com/coinbase/x402/go (Go) Vendor— Affected before 2.5.0 Fixed in 2.5.0 Patch available GHSA-qr2g-p6q7-w82m

Remediation

  • Fix · GHSA-qr2g-p6q7-w82m @x402/svm (npm) Fixed in 2.6.0 Advisory →
  • Fix · GHSA-qr2g-p6q7-w82m x402 (PyPI) Fixed in 2.3.0 Advisory →
  • Fix · GHSA-qr2g-p6q7-w82m github.com/coinbase/x402/go (Go) Fixed in 2.5.0 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-qr2g-p6q7-w82m

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences