GHSA-qr2g-p6q7-w82m x402 SDK Security Advisory

Not scored Published 7 Mar 2026

Facilitators processing Solana payments must upgrade the x402 SDK to mitigate a security vulnerability in outdated versions.

What is GHSA-qr2g-p6q7-w82m?

GHSA-qr2g-p6q7-w82m is a vulnerability in github.com/coinbase/x402/go, published on 7 Mar 2026. It can be exploited over the network.

Official description

A security vulnerability exists in outdated versions of the x402 SDK.

This vulnerability does not affect users' private keys, smart contracts, or funds.

The issue impacts resource servers accepting payments on Solana when the facilitator is running a vulnerable version of the x402 SDK.

Facilitators that process payments on Solana must upgrade the x402 SDK to the patched versions listed below.

Clients are not required to upgrade.

Resource servers are not required to upgrade unless they operate their own facilitator (self-facilitate).

Please update to the following package versions:

7 open source packages ship an affected version, including github.com/coinbase/x402/go, x402 and @x402/svm.

1 more packages

@x402/svm npm All versions 2.6.0

Upgrade github.com/coinbase/x402/go to 2.5.0 or later.

There is no known exploitation of GHSA-qr2g-p6q7-w82m in the wild and no public exploit code.

Also known as GO-2026-4647.