EUVD-2026-84805
GHSA-727h-3vm5-qwq6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated client submits padded calldata with low complexity; sole impact is bounded financial fee-drain on the sponsor wallet (A:L), no confidentiality or integrity effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4Blast Radius
ecosystem impact- 3 npm packages depend on mppx (1 direct, 2 indirect)
Ecosystem-wide dependent count for version 0.8.2.
DescriptionCVE.org
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored calldata but did not reject trailing bytes. A client could append nonzero padding that increased intrinsic calldata gas while gas_limit and max_fee_per_gas remained within policy caps, causing the server fee_payer wallet to pay substantially more than the decoded transaction required. The tested 16 KB header limit bounded the demonstrated padding to about 5,500 bytes and produced approximately five times the normal transaction fee. This issue is fixed in version 0.8.2.
AnalysisAI
Fee-sponsoring servers built on mppx before 0.8.2 can be induced by any client with access to the sponsorship endpoint to pay roughly five times the intended gas fee on otherwise-valid transactions. The FeePayerPolicy validator in src/tempo/internal/fee-payer.ts decoded client-supplied calldata with viem's decodeFunctionData but never rejected trailing bytes, so an attacker could append nonzero padding to a legitimate tip20/stablecoinDex call (transfer, approve, transferWithMemo, swapExactAmountOut) and inflate intrinsic calldata gas while gas_limit and max_fee_per_gas stayed inside the policy caps the server checks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a deployment running mppx (<0.8.2) as a fee-sponsoring server where FeePayerPolicy validates client-supplied fee-sponsored calldata before paying gas. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded economic-griefing flaw, not a system-compromise vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to mppx 0.8.2, the vendor-released patch version (release tag mppx@0.8.2, commit 24ddcca719ae282977d8747309ed1275ea282b25, PR 602; advisory https://github.com/wevm/mppx/security/advisories/GHSA-727h-3vm5-qwq6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in TypeScript
View allJoplin Server instances prior to 3.7.2 expose an SSO login-code redemption endpoint (GET /api/login_with_code/:id) that
Cross-tenant authorization bypass in TinaCMS self-hosted deployments allows any holder of a legitimate TinaCloud account
Authenticated clients on deepstream.io 10.1.0 can bypass record-write authorization and modify arbitrary protected recor
OS command injection in zosmaai's pi-llm-wiki through 0.11.7 lets an attacker who can invoke the wiki_capture_source MCP
Path traversal in decap-server's local proxy containment guard allows an unauthenticated attacker to read, write, or del
A remote, unauthenticated denial-of-service condition in the NestJS (Nest) microservices framework lets an attacker cras
Code escaping sandbox in the PraisonAI npm package's built-in codeMode tool (praisonai 1.4.0 through 1.7.1) lets anyone
Unauthenticated passkey enrollment in OpenReception appointment-booking software prior to 1.1.1 lets remote attackers in
A credential-isolation flaw in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker who controls or can pred
Remote code execution affects Univer v1.0.0-alpha.2 through its Uniscript feature: the UniscriptExecutionService.execute
Dokploy instances running versions prior to 0.29.13 disclose stored Git provider secrets - GitHub App private keys, OAut
Unauthenticated access to the AgentOS HTTP server shipped in the npm `praisonai` package (versions 1.6.0 through 1.7.1)
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today