CVE-2026-34209
HIGH
GHSA-mv9j-8jvg-j8mr
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
3Description
### Impact The `tempo/session` cooperative close handler validated the close voucher amount using `<` instead of `<=` against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free. ### Patches Fixed in 0.4.11. ### Workarounds There are no workarounds available for this vulnerability.
Analysis
A logic error in the mppx npm package (versions <0.4.11) allows remote attackers to close payment channels without committing funds by exploiting an off-by-one validation flaw in the tempo/session cooperative close handler. The handler incorrectly used '<' instead of '<=' when validating close voucher amounts against settled on-chain amounts, enabling attackers to submit vouchers exactly equal to settled amounts for free channel closure or griefing attacks. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all applications and services using mppx npm package and document current versions in use. Within 7 days: Update all affected instances to mppx version 0.4.11 or later and validate the update in a staging environment. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today