Is CVE-2026-34209 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34209 being exploited in the wild.

How severe is CVE-2026-34209?

High severity, with a CVSS score of 7.5, published 31 March 2026.

Which products and versions are affected?

mppx (npm) SEMVER:introduced=0,fixed=0.4.11; Wevm Mppx < 0.4.11.

Is there a fix for CVE-2026-34209?

Yes. mppx (npm): upgrade to 0.4.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34209 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-34209?

Check whether you run mppx (npm) or Wevm Mppx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34209: wevm mppx improper validation in tempo session close handler

Q: Is there a fix for CVE-2026-34209?

Yes. mppx (npm): upgrade to 0.4.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-34209 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-34209?

Check whether you run mppx (npm) or Wevm Mppx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34209 · Severity: high · CVSS 7.5 · Published 2026-03-31

mppx is a software library used to handle automated machine-to-machine payments. A flaw in how the system closes payment sessions allows an attacker to shut down a payment channel without providing the required funds. This can lead to financial discrepancies or 'griefing' attacks where legitimate payment channels are closed prematurely at no cost to the attacker.

Technologies: mppx (npm), Wevm Mppx. Vendors: npm, Wevm.

Quick answers

Is CVE-2026-34209 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34209 being exploited in the wild.
How severe is CVE-2026-34209?: High severity, with a CVSS score of 7.5, published 31 March 2026.
Which products and versions are affected?: mppx (npm) SEMVER:introduced=0,fixed=0.4.11; Wevm Mppx < 0.4.11.
Is there a fix for CVE-2026-34209?: Yes. mppx (npm): upgrade to 0.4.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34209 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-34209?: Check whether you run mppx (npm) or Wevm Mppx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mppx (npm): upgrade to 0.4.11 or later
```
npm install mppx@0.4.11
```

Technical details

A logic error exists in the tempo/session cooperative close handler within the mppx library. The handler validated close voucher amounts using a strict 'less than' (<) comparison instead of 'less than or equal to' (<=) against the on-chain settled amount. This off-by-one logic flaw allows a remote attacker to submit a close voucher exactly equal to the settled amount. The system accepts this voucher as valid without requiring the commitment of new funds, enabling the attacker to close or 'grief' the payment channel for free. The issue is categorized as a form of authentication bypass via replay/logic manipulation (CWE-294) and has been patched in version 0.4.11.

Affected products

wevm mppx < 0.4.11

Identifiers

CVE-2026-34209
GHSA-mv9j-8jvg-j8mr

Timeline

2026-03-26: patched: Version 0.4.11 released
2026-03-31: disclosed: CVE-2026-34209 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.