Is CVE-2026-63628 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63628 being exploited in the wild.

How severe is CVE-2026-63628?

Medium severity, published 22 September 2026.

Which products and versions are affected?

mppx (npm) SEMVER:introduced=0,fixed=0.8.2.

Is there a fix for CVE-2026-63628?

Yes. mppx (npm): upgrade to 0.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63628 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-63628?

Check whether you run mppx (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63628: mppx gas draining via EIP-2930 access list

CVE-2026-63628 · Severity: medium · Published 2026-09-22

mppx is a TypeScript library that manages fee-payer transaction signing for blockchain transactions. An attacker can craft transactions with a bloated EIP-2930 access list that causes the fee-payer to pay 9.4× the normal transaction fee through intrinsic gas charges, with no corresponding on-chain work performed. This significantly increases operational costs and destroys profit margins on low-cost transactions.

Technologies: mppx (npm). Vendors: npm.

Quick answers

Is CVE-2026-63628 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63628 being exploited in the wild.
How severe is CVE-2026-63628?: Medium severity, published 22 September 2026.
Which products and versions are affected?: mppx (npm) SEMVER:introduced=0,fixed=0.8.2.
Is there a fix for CVE-2026-63628?: Yes. mppx (npm): upgrade to 0.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63628 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-63628?: Check whether you run mppx (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mppx (npm): upgrade to 0.8.2 or later
```
npm install mppx@0.8.2
```

Technical details

The vulnerability exists in mppx 0.6.27's fee-payer cosigning path, which accepts and copies the client-supplied EIP-2930 access list verbatim into the transaction without validating its length or contents. Access list gas is charged intrinsically before any opcode execution, regardless of whether the listed addresses are used. An attacker can submit a valid `transferWithMemo` call with a fabricated access list containing up to 180 dummy address-only entries, inflating the intrinsic gas cost from ~51,287 to ~483,287 gas (9.4× increase) while remaining within the 500K gas cap enforced by `FeePayerPolicy`. The server validates calldata and gas parameters but never inspects the access list, resulting in the cosigner broadcasting the inflated transaction.

Affected products

mppx mppx 0.6.27

Identifiers

CVE-2026-63628
GHSA-vc9j-9wph-qghj

Timeline

2026-09-22: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.