{"cve":"CVE-2026-34209","nvd":{"published":"2026-03-31T15:16:18.030","modified":"2026-07-24T21:10:00.143","status":"Analyzed","description":"mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using \"<\" instead of \"<=\" against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free. This issue has been patched in version 0.4.11.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5},"cwes":["CWE-294"],"references":["https://github.com/wevm/mppx/commit/94088246ee18f21b5d6be40d9e7a464f5a280bfb","https://github.com/wevm/mppx/releases/tag/mppx@0.4.11","https://github.com/wevm/mppx/security/advisories/GHSA-mv9j-8jvg-j8mr"],"products":["wevm:mppx"],"source":"nvd","synced_at":"2026-10-19T22:28:18.033120106+00:00"},"epss":{"cve":"CVE-2026-34209","score":0.00373,"percentile":0.31232,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-mv9j-8jvg-j8mr","url":"https://osv.dev/vulnerability/GHSA-mv9j-8jvg-j8mr","summary":"mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality","modified":"2026-03-31T19:05:19.688464Z","packages":[{"ecosystem":"npm","name":"mppx","purl":"pkg:npm/mppx","ranges":["<0.4.11"],"fixed":["0.4.11"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}