CVE-2026-34209 mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality
Attackers can bypass session close validation to close payment channels without committing funds, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34209?
CVE-2026-34209 is a high-severity vulnerability in wevm mppx, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using "<" instead of "<=" against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free. This issue has been patched in version 0.4.11.
Weakness: CWE-294
Which versions are affected by CVE-2026-34209?
2 open source packages ship an affected version, including mppx. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mppx npm | All versions | 0.4.11 |
mppx npm | All versions | 0.4.11 |
Products include Wevm Mppx.
How do I fix CVE-2026-34209?
Upgrade mppx to 0.4.11 or later.
Is CVE-2026-34209 being exploited?
There is no known exploitation of CVE-2026-34209 in the wild and no public exploit code.
Other vulnerabilities in wevm mppx
Sources
Also known as GHSA-mv9j-8jvg-j8mr.