mppx has multiple payment bypass and griefing vulnerabilities
Impact
Multiple vulnerabilities were discovered in tempo/charge and tempo/session which allowed for undesirable behaviors, including:
- Replaying
tempo/chargetransaction hashes across push/pull modes, across charge/session endpoints, and via concurrent requests - Performing free
tempo/chargerequests due to missing transfer log verification in pull-mode - Replaying
tempo/chargecredentials across routes via cross-route scope confusion (memo/splitsnot included in scope binding) - Manipulating the fee payer of a
tempo/chargehandler into paying for requests (missing sender signature before co-signing) - Bypassing
tempo/sessionvoucher signature verification - Piggybacking off existing
tempo/sessionchannels via settle voucher reuse and weak channel ID binding - Performing free
tempo/sessionrequests by exploiting channel reopen without on-chain settled state - Accepting deductions on finalized
tempo/sessionchannels - Bypassing payment on free routes via method-mismatch fallback
- Griefing
tempo/sessionchannels via force-close detection bypass (closeRequestedAtnot persisted)
Patches
Fixed in 0.4.8.
Workarounds
There are no workarounds available for these vulnerabilities.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | mppx | < 0.4.8 | 0.4.8 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N- Weakness (CWE)
CWE-288, CWE-294, CWE-345- Platform
- npm
- Package
mppx- Disclosed
- 29.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-8x4m-qw58-3pcx - CC BY 4.0
Vulnerability history: mppx
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 03.2026 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 1
- Medium 3
Disclosures per year
- 2026: 5
-
mppx has multiple payment bypass and griefing vulnerabilities this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.