VulnerabilityAnalyzed

CVE-2026-34209

An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free.

HIGH 7.5EPSS 0.36%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.36%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using "<" instead of "<=" against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free. This issue has been patched in version 0.4.11.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS: 0.36% probability · 29th percentile
CISA KEV: Not listed
Weakness: CWE-294
Affected: wevm/mppx
Source: security-advisories@github.com

References

https://github.com/wevm/mppx/commit/94088246ee18f21b5d6be40d9e7a464f5a280bfbPatch
https://github.com/wevm/mppx/releases/tag/mppx@0.4.11Release Notes
https://github.com/wevm/mppx/security/advisories/GHSA-mv9j-8jvg-j8mrPatch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.