CVE-2026-63628 mppx: Gas Draining with access list
Attackers can inflate transaction fees for the fee-payer wallet by injecting fabricated access-list entries, causing financial denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63628?
CVE-2026-63628 is a medium-severity denial of service vulnerability in wevm mppx, published on 22 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied access_list from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume intrinsic gas even when the listed addresses are never used, a client could add fabricated address-only entries and cause the server fee_payer wallet to pay unnecessary transaction fees. The demonstrated 180-entry list remained within the 500,000 gas policy cap, 16 KB header limit, and RPC simulation budget while increasing the fee by approximately 9.4 times. This issue is fixed in version 0.8.2.
Weakness: CWE-20
Which versions are affected by CVE-2026-63628?
2 open source packages ship an affected version, including mppx.
| Package | Affected | Fixed in |
|---|---|---|
mppx npm | All versions | 0.8.2 |
mppx npm | All versions | 0.8.2 |
How do I fix CVE-2026-63628?
Upgrade mppx to 0.8.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-63628 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63628 exists.
Sources
Also known as GHSA-vc9j-9wph-qghj.