Summary
mppx has multiple payment bypass and griefing vulnerabilities
Workarounds
There are no workarounds available for these vulnerabilities.
Impact
Multiple vulnerabilities were discovered in tempo/charge and tempo/session which allowed for undesirable behaviors, including:
- Replaying
tempo/chargetransaction hashes across push/pull modes, across charge/session endpoints, and via concurrent requests - Performing free
tempo/chargerequests due to missing transfer log verification in pull-mode - Replaying
tempo/chargecredentials across routes via cross-route scope confusion (memo/splitsnot included in scope binding) - Manipulating the fee payer of a
tempo/chargehandler into paying for requests (missing sender signature before co-signing) - Bypassing
tempo/sessionvoucher signature verification - Piggybacking off existing
tempo/sessionchannels via settle voucher reuse and weak channel ID binding - Performing free
tempo/sessionrequests by exploiting channel reopen without on-chain settled state - Accepting deductions on finalized
tempo/sessionchannels - Bypassing payment on free routes via method-mismatch fallback
- Griefing
tempo/sessionchannels via force-close detection bypass (closeRequestedAtnot persisted)
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Fixed in 0.4.8.
Frequently Asked Questions
- What is GHSA-8X4M-QW58-3PCX? GHSA-8X4M-QW58-3PCX is a critical-severity security vulnerability in mppx (npm), affecting versions < 0.4.8. It is fixed in 0.4.8.
- Which versions of mppx are affected by GHSA-8X4M-QW58-3PCX? mppx (npm) versions < 0.4.8 is affected.
- Is there a fix for GHSA-8X4M-QW58-3PCX? Yes. GHSA-8X4M-QW58-3PCX is fixed in 0.4.8. Upgrade to this version or later.
- Is GHSA-8X4M-QW58-3PCX exploitable, and should I be worried? Whether GHSA-8X4M-QW58-3PCX is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-8X4M-QW58-3PCX is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-8X4M-QW58-3PCX? Upgrade
mppxto 0.4.8 or later.