TypeScript Interface Vulnerability in Machine Payments Protocol by WeVM

CVE-2026-34209

What is CVE-2026-34209?

A vulnerability in the mppx TypeScript interface for the machine payments protocol allows an attacker to exploit the close voucher handling mechanism. Prior to version 0.4.11, the system erroneously validated close voucher amounts using a '<' condition rather than '<='. This flaw permits an attacker to submit a close voucher equal to the settled amount, thereby closing channels without the need to commit new funds. This behavior can be exploited to effectively grief the payment channel, leading to potential service disruptions. Users are advised to update to version 0.4.11 or later to mitigate this security risk.

References