Executive brief
The x402 SDK is a payment processing library used by facilitators to accept payments on the Solana blockchain. A security vulnerability in outdated versions can be exploited to compromise payment processing for resource servers that use vulnerable facilitators, though it does not directly affect private keys, smart contracts, or user funds. Facilitators must upgrade immediately to the patched versions to restore secure payment operations.
Technical details
The x402 SDK contains a security vulnerability affecting payment processing on Solana when facilitators run vulnerable versions. The vulnerability is present in all versions before the patched releases: npm @x402/svm < 2.6.0, PyPI x402 < 2.3.0, and Go x402 < 2.5.0. The vulnerability impacts facilitators processing payments and can be exploited over the network by attackers interacting with payment flows. The exact attack vector and root cause are not disclosed, but the advisory confirms the issue does not compromise private keys, smart contracts, or funds directly. Patches are available across all three package ecosystems and should be deployed immediately by facilitators.
Affected products
- x402-foundation x402 SDK (npm @x402/svm) < 2.6.0
- x402-foundation x402 SDK (PyPI x402) < 2.3.0
- x402-foundation x402 SDK (Go) < 2.5.0
Timeline
- 2026-03-07: disclosed: Security advisory published