npm/mppx CVE-2026-34210: medium, EPSS 0.57%
mppx has Stripe charge credential replay via missing idempotency check
Action: Upgrade mppx to 0.4.11 or later.
npm i mppx@0.4.11Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.4.11 | - |
Fixed versions
| 0.4.11 |
Sources
- osv: GHSA-8mhj-rffc-rcvw
- https://github.com/wevm/mppx/security/advisories/GHSA-8mhj-rffc-rcvw
- https://nvd.nist.gov/vuln/detail/CVE-2026-34210
- https://github.com/wevm/mppx/commit/b2b1a0b60506fc71aa80b8a025084949dca1a994
- https://github.com/wevm/mppx
- https://github.com/wevm/mppx/releases/tag/mppx%400.4.11
- https://github.com/wevm/mppx/releases/tag/mppx@0.4.11
CVE-2026-34210 · published · modified · JSON