TypeScript Interface Vulnerability in mppx Payment Protocol
CVE-2026-63627

6.9MEDIUM

Key Information:

Vendor

Wevm

Status
Mppx
Vendor
CVE Published:
22 September 2026

What is CVE-2026-63627?

The mppx payment protocol introduced a vulnerability in the FeePayerPolicy where improper handling of calldata allowed clients to append nonzero padding. This manipulation resulted in inflated transaction fees as the fee_payer wallet could be charged significantly more than necessary. Specifically, the tested header limit showed that padding could escalate transaction costs up to five times the normal rate. This flaw has been addressed in version 0.8.2, enhancing the validation mechanism to reject trailing bytes and protect users from excessive charges.

Affected Version(s)

mppx < 0.8.2

References

https://github.com/wevm/mppx/security/advisories/GHSA-727...
x_refsource_CONFIRM
https://github.com/wevm/mppx/pull/602
x_refsource_MISC
https://github.com/wevm/mppx/commit/24ddcca719ae282977d87...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.