GitHub Advisoryadvisory · npm
GHSA-3j63-5h8p-gf7c x402 SDK vulnerable in outdated versions in resource servers for builders
HIGH
Official page ↗
- Ecosystem
- npm
- Packages
- x402, x402-next, x402-express, x402-hono
- Severity
- High
- Reviewed
- 2025-08-20
Affected packages
• npm x402: < 0.5.2 → fixed in 0.5.2
• npm x402-next: < 0.5.2 → fixed in 0.5.2
• npm x402-express: < 0.5.2 → fixed in 0.5.2
• npm x402-hono: < 0.5.2 → fixed in 0.5.2
Description
Impact
There is a security vulnerability in outdated versions of the x402 SDK. This does not directly affect users' keys, smart contracts, or funds.
This primarily impacts builders working on resource servers.
Patches
Please update to the following package versions:
• x402 >= 0.5.2
• x402-next >= 0.5.2
• x402-express >= 0.5.2
• x402-hono >= 0.5.2