{"action":"Upgrade mppx to 0.4.11 or later.","affected":[{"fixed":"0.4.11","introduced":"0"}],"component":"mppx","cve_ids":["CVE-2026-34210"],"ecosystem":"npm","epss":0.00573,"exploited":false,"fixed_versions":["0.4.11"],"ghsa_id":"GHSA-8mhj-rffc-rcvw","id":"tcs_01M5KFDFJZMT09C3SWDAWV9FK3","modified_at":"2026-03-31T19:05:06.644346Z","published_at":"2026-03-29T15:11:30Z","references":["https://osv.dev/vulnerability/GHSA-8mhj-rffc-rcvw","https://github.com/wevm/mppx/security/advisories/GHSA-8mhj-rffc-rcvw","https://nvd.nist.gov/vuln/detail/CVE-2026-34210","https://github.com/wevm/mppx/commit/b2b1a0b60506fc71aa80b8a025084949dca1a994","https://github.com/wevm/mppx","https://github.com/wevm/mppx/releases/tag/mppx%400.4.11","https://github.com/wevm/mppx/releases/tag/mppx@0.4.11"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-8mhj-rffc-rcvw","url":"https://osv.dev/vulnerability/GHSA-8mhj-rffc-rcvw"}],"summary":"mppx has Stripe charge credential replay via missing idempotency check"}