GitHub Advisoryadvisory · npm

GHSA-mv9j-8jvg-j8mr mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality

HIGH Published 2026-03-29 Modified 2026-03-31 Official page ↗
Aliases
CVE-2026-34209
Ecosystem
npm
Packages
mppx
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-294
Reviewed
2026-03-29

Affected packages

• npm mppx: < 0.4.11 → fixed in 0.4.11

Description

Impact The `tempo/session` cooperative close handler validated the close voucher amount using `<` instead of `<=` against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free. Patches Fixed in 0.4.11. Workarounds There are no workarounds available for this vulnerability.

Related

Alias · CVE (1)

  • CVE-2026-34209 mppx is a TypeScript interface for machine payments protocol. vulnerability

Weakness · CWE (1)

  • CWE-294 Authentication Bypass by Capture-replay weakness

References