Is CVE-2026-63627 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63627 being exploited in the wild.

How severe is CVE-2026-63627?

Medium severity, with a CVSS score of 4, published 22 September 2026.

Which products and versions are affected?

mppx (npm) SEMVER:introduced=0,fixed=0.8.2.

Is there a fix for CVE-2026-63627?

Yes. mppx (npm): upgrade to 0.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63627 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-63627?

Check whether you run mppx (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63627: mppx gas draining via calldata padding

CVE-2026-63627 · Severity: medium · CVSS 4 · Published 2026-09-22

mppx is a library used to handle fee-payer transactions in blockchain applications. When the server acts as the fee payer, a malicious client can append unnecessary padding bytes to transaction calldata, inflating actual gas costs to roughly 5x normal rates while bypassing the library's fee caps. This forces the server's fee-payer wallet to cover inflated transaction fees, dramatically increasing operational costs and eliminating profitability on low-cost transactions.

Technologies: mppx (npm). Vendors: npm.

Quick answers

Is CVE-2026-63627 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63627 being exploited in the wild.
How severe is CVE-2026-63627?: Medium severity, with a CVSS score of 4, published 22 September 2026.
Which products and versions are affected?: mppx (npm) SEMVER:introduced=0,fixed=0.8.2.
Is there a fix for CVE-2026-63627?: Yes. mppx (npm): upgrade to 0.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63627 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-63627?: Check whether you run mppx (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mppx (npm): upgrade to 0.8.2 or later
```
npm install mppx@0.8.2
```

Technical details

The vulnerability is a gas-draining attack exploiting incomplete validation in mppx's FeePayerPolicy. While the policy enforces caps on gas_limit (≤2M) and max_fee_per_gas (≤100 Gwei), it does not validate calldata length. An attacker appends non-zero padding bytes to transaction calldata, which cost 16 gas each under Tempo's legacy pricing model, inflating actual gas consumption without exceeding the declared gas_limit or fee caps. The attack requires the server to act as fee payer and co-sign the transaction; a proof-of-concept demonstrates achieving ~5x fee inflation within a 16 KB max_header_length constraint. The root cause is that intrinsic calldata gas cost is not accounted for in the FeePayerPolicy validation logic.

Affected products

mppx mppx 0.6.27

Identifiers

CVE-2026-63627
GHSA-727h-3vm5-qwq6

Timeline

2026-09-22: disclosed: GHSA advisory published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.