CVE-2026-34209

Name of the Vulnerable Software and Affected Versions mppx versions prior to 0.4.11

Description mppx is a TypeScript interface for machine payments protocol. The tempo/session cooperative close handler incorrectly validated the close voucher amount using '<' instead of '<=' against the on-chain settled amount. This allowed an attacker to submit a close voucher equal to the settled amount, bypassing fund commitment and potentially closing or disrupting the channel. The vulnerable component is the tempo/session cooperative close handler.

Recommendations Update to version 0.4.11 or later.