mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality

CAO 7.5CVE-2026-34209 · GHSA-mv9j-8jvg-j8mr · Công bố 31/03/2026 · cập nhật 24/07/2026

Tóm tắt nhanh

CVE-2026-34209 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng mppx (wevm), mppx.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.37%, cao hơn 31.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 0.4.11 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
mppx wevm	`< 0.4.11`	`0.4.11`
mppx npm	`< 0.4.11`	`0.4.11`

Mô tả

Impact

The tempo/session cooperative close handler validated the close voucher amount using < instead of <= against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free.

Patches

Fixed in 0.4.11.

Workarounds

There are no workarounds available for this vulnerability.

Mô tả của NVD

mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using "<" instead of "<=" against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free. This issue has been patched in version 0.4.11.