CVE-2026-34209
HIGH
GHSA-mv9j-8jvg-j8mr
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
3DescriptionNVD
Impact
The tempo/session cooperative close handler validated the close voucher amount using < instead of <= against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free.
Patches
Fixed in 0.4.11.
Workarounds
There are no workarounds available for this vulnerability.
AnalysisAI
A logic error in the mppx npm package (versions <0.4.11) allows remote attackers to close payment channels without committing funds by exploiting an off-by-one validation flaw in the tempo/session cooperative close handler. The handler incorrectly used '<' instead of '<=' when validating close voucher amounts against settled on-chain amounts, enabling attackers to submit vouchers exactly equal to settled amounts for free channel closure or griefing attacks. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all applications and services using mppx npm package and document current versions in use. Within 7 days: Update all affected instances to mppx version 0.4.11 or later and validate the update in a staging environment. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today