Is CVE-2026-34210 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34210 being exploited in the wild.

How severe is CVE-2026-34210?

High severity, with a CVSS score of 8.1, published 31 March 2026.

Which products and versions are affected?

mppx (npm) SEMVER:introduced=0,fixed=0.4.11; Wevm Mppx < 0.4.11.

Is there a fix for CVE-2026-34210?

Yes. mppx (npm): upgrade to 0.4.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34210 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-34210?

Check whether you run mppx (npm) or Wevm Mppx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34210: wevm mppx credential replay in stripe/charge payment method

Q: Is there a fix for CVE-2026-34210?

Yes. mppx (npm): upgrade to 0.4.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-34210 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-34210?

Check whether you run mppx (npm) or Wevm Mppx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34210 · Severity: high · CVSS 8.1 · Published 2026-03-31

mppx is a TypeScript library used for handling machine-to-machine payments. A security flaw in its Stripe payment integration allows an attacker to reuse a single successful payment credential multiple times. This could allow a malicious user to pay for a service once and then consume unlimited resources or services without being charged again, leading to significant financial loss for the provider.

Technologies: mppx (npm), Wevm Mppx. Vendors: npm, Wevm.

Quick answers

Is CVE-2026-34210 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34210 being exploited in the wild.
How severe is CVE-2026-34210?: High severity, with a CVSS score of 8.1, published 31 March 2026.
Which products and versions are affected?: mppx (npm) SEMVER:introduced=0,fixed=0.4.11; Wevm Mppx < 0.4.11.
Is there a fix for CVE-2026-34210?: Yes. mppx (npm): upgrade to 0.4.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34210 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-34210?: Check whether you run mppx (npm) or Wevm Mppx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mppx (npm): upgrade to 0.4.11 or later
```
npm install mppx@0.4.11
```

Technical details

A credential replay vulnerability exists in the stripe/charge payment method of the mppx library. The root cause is an incorrect comparison (CWE-697) where the server fails to validate Stripe's 'Idempotent-Replayed' response header when creating PaymentIntents. An attacker with low privileges can capture a valid credential containing a specific 'spt' token and replay it against new challenges. Because the server does not detect that the Stripe PaymentIntent has already been processed, it treats the replayed request as a new successful payment without initiating a new charge. This issue is fixed in version 0.4.11 by implementing mandatory checks for the idempotency header.

Affected products

wevm mppx < 0.4.11

Identifiers

CVE-2026-34210
GHSA-8mhj-rffc-rcvw

Timeline

2026-03-26: patched: Version 0.4.11 released with fix
2026-03-31: disclosed: Security advisory published by GitHub and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.