{"action":"Upgrade mppx to 0.4.11 or later.","affected":[{"fixed":"0.4.11","introduced":"0"}],"component":"mppx","cve_ids":["CVE-2026-34209"],"ecosystem":"npm","epss":0.00359,"exploited":false,"fixed_versions":["0.4.11"],"ghsa_id":"GHSA-mv9j-8jvg-j8mr","id":"tcs_01M5KG1R6KJZKVRVJCKB7VTW8K","modified_at":"2026-03-31T19:05:19.688464Z","published_at":"2026-03-29T15:10:03Z","references":["https://osv.dev/vulnerability/GHSA-mv9j-8jvg-j8mr","https://github.com/wevm/mppx/security/advisories/GHSA-mv9j-8jvg-j8mr","https://nvd.nist.gov/vuln/detail/CVE-2026-34209","https://github.com/wevm/mppx/commit/94088246ee18f21b5d6be40d9e7a464f5a280bfb","https://github.com/wevm/mppx","https://github.com/wevm/mppx/releases/tag/mppx@0.4.11"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-mv9j-8jvg-j8mr","url":"https://osv.dev/vulnerability/GHSA-mv9j-8jvg-j8mr"}],"summary":"mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality"}