CVE-2026-34209

This vulnerability affects the mppx package, a Node.js/npm library implementing payment channel primitives. Payment channels are cryptographic constructs that allow parties to conduct multiple off-chain transactions before settling final balances on-chain. The tempo/session cooperative close handler is responsible for validating close vouchers-cryptographic proofs of agreed channel closure amounts-before executing channel settlement. The root cause is CWE-294 (Authentication Bypass by Capture-replay), manifesting as an off-by-one comparison error. The code validated voucher amounts using a strict less-than comparison (amount < settled_amount) instead of less-than-or-equal-to (amount <= settled_amount). This boundary condition error meant vouchers with amounts exactly equal to the settled amount would pass validation without requiring the attacker to lock any additional funds, violating the protocol's economic security model. The affected package is distributed via npm under the identifier pkg:npm/mppx.