GitHub Advisoryadvisory · npm

GHSA-8mhj-rffc-rcvw mppx has Stripe charge credential replay via missing idempotency check

MEDIUM Published 2026-03-29 Modified 2026-03-31 Official page ↗
Aliases
CVE-2026-34210
Ecosystem
npm
Packages
mppx
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-697
Reviewed
2026-03-29

Affected packages

• npm mppx: < 0.4.11 → fixed in 0.4.11

Description

Impact The `stripe/charge` payment method did not check Stripe's `Idempotent-Replayed` response header when creating PaymentIntents. An attacker could replay a valid credential containing the same `spt` token against a new challenge, and the server would accept the replayed Stripe PaymentIntent as a new successful payment without actually charging the customer again. This allowed an attacker to pay once and consume unlimited resources by replaying the credential. Patches Fixed in 0.4.11. The server now checks the `Idempotent-Replayed` header and rejects replayed PaymentIntents. Workarounds There are no workarounds available for this vulnerability.

Related

Alias · CVE (1)

  • CVE-2026-34210 mppx is a TypeScript interface for machine payments protocol. vulnerability

Weakness · CWE (1)

  • CWE-697 Incorrect Comparison weakness

References