Vulnerability · Published Mar 31, 2026 · Assigned by GitHub_M

CVE-2026-34209mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality

High 7.5

In plain English

A high-severity security flaw in mppx from wevm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 68.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using "<" instead of "<=" against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free. This issue has been patched in version 0.4.11.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	mppx	0.4.11	GHSA-mv9j-8jvg-j8mr

Affected products (as reported)

Vendor	Product	Versions
wevm	mppx	< 0.4.11

Weakness: CWE-294 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/wevm/mppx/security/advisories/GHSA-mv9j-8jvg-j8mr x_refsource_CONFIRM
https://github.com/wevm/mppx/commit/94088246ee18f21b5d6be40d9e7a464f5a280bfb x_refsource_MISC
https://github.com/wevm/mppx/releases/tag/mppx@0.4.11 x_refsource_MISC