CVE-2026-63627

Name of the Vulnerable Software and Affected Versions mppx versions prior to 0.8.2

Description In the FeePayerPolicy within src/tempo/internal/fee-payer.ts, the software uses the decodeFunctionData() function to validate fee-sponsored calldata but fails to reject trailing bytes. A client can append nonzero padding to the calldata, which increases the intrinsic calldata gas cost. Because the policy only caps gas limit and max fee per gas without checking the actual calldata length, the server's fee-payer wallet may pay significantly more than the decoded transaction requires. In tested scenarios, a 16 KB header limit allowed padding of approximately 5,500 bytes, resulting in transaction fees roughly five times higher than normal.

Recommendations Update mppx to version 0.8.2.