Vulnerability · Published Sep 22, 2026 · Assigned by GitHub_M

CVE-2026-63628mppx: Gas Draining with access list

Medium 6.9

In plain English

A medium-severity improper input validation in mppx from wevm. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.5%top 57.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied access_list from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume intrinsic gas even when the listed addresses are never used, a client could add fabricated address-only entries and cause the server fee_payer wallet to pay unnecessary transaction fees. The demonstrated 180-entry list remained within the 500,000 gas policy cap, 16 KB header limit, and RPC simulation budget while increasing the fee by approximately 9.4 times. This issue is fixed in version 0.8.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	mppx	0.8.2	GHSA-vc9j-9wph-qghj

Affected products (as reported)

Vendor	Product	Versions
wevm	mppx	< 0.8.2

Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

https://github.com/wevm/mppx/security/advisories/GHSA-vc9j-9wph-qghj x_refsource_CONFIRM
https://github.com/wevm/mppx/pull/602 x_refsource_MISC
https://github.com/wevm/mppx/commit/24ddcca719ae282977d8747309ed1275ea282b25 x_refsource_MISC
https://github.com/wevm/mppx/releases/tag/mppx@0.8.2 x_refsource_MISC