CVE-2026-34209

npm/mppx CVE-2026-34209: high 7.5, EPSS 0.44%

mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality

Action: Upgrade mppx to 0.4.11 or later.

npm i mppx@0.4.11

Affected

Fixed versions

Sources

• osv: GHSA-mv9j-8jvg-j8mr
• https://github.com/wevm/mppx/security/advisories/GHSA-mv9j-8jvg-j8mr
• https://nvd.nist.gov/vuln/detail/CVE-2026-34209
• https://github.com/wevm/mppx/commit/94088246ee18f21b5d6be40d9e7a464f5a280bfb
• https://github.com/wevm/mppx
• https://github.com/wevm/mppx/releases/tag/mppx@0.4.11

CVE-2026-34209 · published 2026-03-29T15:10:03Z · modified 2026-03-31T19:05:19.688464Z · JSON