mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using "<" instead of "<=" against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free. This issue has been patched in version 0.4.11.
References
| Link | Resource |
|---|---|
| https://github.com/wevm/mppx/commit/94088246ee18f21b5d6be40d9e7a464f5a280bfb | Patch |
| https://github.com/wevm/mppx/releases/tag/mppx@0.4.11 | Release Notes |
| https://github.com/wevm/mppx/security/advisories/GHSA-mv9j-8jvg-j8mr | Patch Vendor Advisory |
Configurations
History
03 Apr 2026, 15:59
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/wevm/mppx/commit/94088246ee18f21b5d6be40d9e7a464f5a280bfb - Patch | |
| References | () https://github.com/wevm/mppx/releases/tag/mppx@0.4.11 - Release Notes | |
| References | () https://github.com/wevm/mppx/security/advisories/GHSA-mv9j-8jvg-j8mr - Patch, Vendor Advisory | |
| First Time |
Wevm
Wevm mppx |
|
| CPE | cpe:2.3:a:wevm:mppx:*:*:*:*:*:node.js:*:* |
31 Mar 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-31 15:16
Updated : 2026-04-03 15:59
NVD link : CVE-2026-34209
Mitre link : CVE-2026-34209
CVE.ORG link : CVE-2026-34209
JSON object : View
Products Affected
wevm
- mppx
CWE
CWE-294
Authentication Bypass by Capture-replay