GHSA-mv9j-8jvg-j8mr

mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality

Source: GitHub Advisory Database (reviewed) High CVE-2026-34209

Packages

Ecosystem	Package	Affected	Fixed in
npm	mppx	< 0.4.11	0.4.11

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The `tempo/session` cooperative close handler validated the close voucher amount using `<` instead of `<=` against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free. ### Patches Fixed in 0.4.11. ### Workarounds There are no workarounds available for this vulnerability.

References

External links from the advisory. They lead to third-party sites.

https://github.com/wevm/mppx/security/advisories/GHSA-mv9j-8jvg-j8mr web
https://nvd.nist.gov/vuln/detail/CVE-2026-34209 advisory
https://github.com/wevm/mppx/commit/94088246ee18f21b5d6be40d9e7a464f5a280bfb web
https://github.com/wevm/mppx package
https://github.com/wevm/mppx/releases/tag/[email protected] web