PT-2026-28608 · Npm · Mppx

Published 2026-03-29 · Updated 2026-03-29 · CVE-2026-34210

OSV

CVSS v4.0

6.0

Medium

AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Impact

The stripe/charge payment method did not check Stripe's Idempotent-Replayed response header when creating PaymentIntents. An attacker could replay a valid credential containing the same spt token against a new challenge, and the server would accept the replayed Stripe PaymentIntent as a new successful payment without actually charging the customer again. This allowed an attacker to pay once and consume unlimited resources by replaying the credential.

Patches

Fixed in 0.4.11. The server now checks the Idempotent-Replayed header and rejects replayed PaymentIntents.

Workarounds

There are no workarounds available for this vulnerability.

Fix

Weakness Enumeration

CWE-697

Related Identifiers

CVE-2026-34210

GHSA-8MHJ-RFFC-RCVW

Affected Products

Mppx

References · 5

• https://osv.dev/vulnerability/GHSA-8mhj-rffc-rcvw · Vendor Advisory
• https://github.com/wevm/mppx/security/advisories/GHSA-8mhj-rffc-rcvw · Note
• https://github.com/wevm/mppx · Note
• https://github.com/wevm/mppx/commit/b2b1a0b60506fc71aa80b8a025084949dca1a994 · Note
• https://github.com/wevm/mppx/releases/tag/mppx%400.4.11 · Note