# CVE-2026-34210: wevm mppx credential replay in stripe/charge payment method

Source: https://junglewise.ai/threats/cve-2026-34210-wevm-mppx-credential-replay-in-stripe-charge-payment-method  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-34210 · Severity: high · CVSS 8.1 · Published 2026-03-31

mppx is a TypeScript library used for handling machine-to-machine payments. A security flaw in its Stripe payment integration allows an attacker to reuse a single successful payment credential multiple times. This could allow a malicious user to pay for a service once and then consume unlimited resources or services without being charged again, leading to significant financial loss for the provider.

Technologies: [mppx (npm)](https://junglewise.ai/threats/technologies/npm-mppx), [Wevm Mppx](https://junglewise.ai/threats/technologies/mppx). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Wevm](https://junglewise.ai/threats/vendors/wevm).

## Quick answers

**Is CVE-2026-34210 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34210 being exploited in the wild.

**How severe is CVE-2026-34210?** High severity, with a CVSS score of 8.1, published 31 March 2026.

**Which products and versions are affected?** mppx (npm) SEMVER:introduced=0,fixed=0.4.11; Wevm Mppx < 0.4.11.

**Is there a fix for CVE-2026-34210?** Yes. mppx (npm): upgrade to 0.4.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34210 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-34210?** Check whether you run mppx (npm) or Wevm Mppx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mppx (npm): upgrade to 0.4.11 or later

  ```sh
  npm install mppx@0.4.11
  ```


## Technical details

A credential replay vulnerability exists in the stripe/charge payment method of the mppx library. The root cause is an incorrect comparison (CWE-697) where the server fails to validate Stripe's 'Idempotent-Replayed' response header when creating PaymentIntents. An attacker with low privileges can capture a valid credential containing a specific 'spt' token and replay it against new challenges. Because the server does not detect that the Stripe PaymentIntent has already been processed, it treats the replayed request as a new successful payment without initiating a new charge. This issue is fixed in version 0.4.11 by implementing mandatory checks for the idempotency header.

## Affected products

- wevm mppx < 0.4.11

## Identifiers

- CVE-2026-34210
- GHSA-8mhj-rffc-rcvw

## Timeline

- 2026-03-26: patched: Version 0.4.11 released with fix
- 2026-03-31: disclosed: Security advisory published by GitHub and NVD

## References

- [https://github.com/wevm/mppx/commit/b2b1a0b60506fc71aa80b8a025084949dca1a994](https://github.com/wevm/mppx/commit/b2b1a0b60506fc71aa80b8a025084949dca1a994)
- [https://github.com/wevm/mppx/releases/tag/mppx@0.4.11](https://github.com/wevm/mppx/releases/tag/mppx@0.4.11)
- [https://github.com/wevm/mppx/security/advisories/GHSA-8mhj-rffc-rcvw](https://github.com/wevm/mppx/security/advisories/GHSA-8mhj-rffc-rcvw)

## Related threats

- [mppx gas draining via EIP-2930 access list](https://junglewise.ai/threats/cve-2026-63628-mppx-gas-draining-via-eip-2930-access-list)
- [mppx gas draining via calldata padding](https://junglewise.ai/threats/cve-2026-63627-mppx-gas-draining-via-calldata-padding)
- [wevm mppx improper validation in tempo session close handler](https://junglewise.ai/threats/cve-2026-34209-wevm-mppx-improper-validation-in-tempo-session-close-handler)
- [mppx multiple payment bypass and griefing vulnerabilities](https://junglewise.ai/threats/mppx-multiple-payment-bypass-and-griefing-vulnerabilities-0a27d3d4)