CVE-2026-34209: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34209 is a session close voucher bypass vulnerability in the mppx npm package (by wevm) affecting the tempo/session cooperative close handler. The flaw allows an unauthenticated remote attacker to close or grief a payment channel without committing any new funds by submitting a close voucher amount exactly equal to the on-chain settled amount. All versions of mppx prior to 0.4.11 for Node.js are affected. The vulnerability was disclosed on March 26, 2026, published to the GitHub Advisory Database on March 29, 2026, and assigned a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, wevm Security Advisory).

The root cause is an off-by-one comparison error (CWE-294: Authentication Bypass by Capture-replay) in src/tempo/server/Session.ts. The handleClose function used a strict less-than operator (<) instead of less-than-or-equal (<=) when validating the close voucher's cumulativeAmount against the on-chain settled amount: if (voucher.cumulativeAmount < minCloseAmount). This allowed a voucher with cumulativeAmount exactly equal to onChain.settled to pass validation, since it was not strictly less than the threshold. An attacker with knowledge of the on-chain settled amount — which is publicly observable on-chain — could craft and submit such a voucher remotely, with no privileges or user interaction required. The fix in commit 9408824 splits the check into two separate conditions: one ensuring the amount exceeds channel.spent (>=) and another ensuring it strictly exceeds onChain.settled (>) (GitHub Commit, GitHub Advisory).

Successful exploitation allows an attacker to close a payment channel cooperatively without contributing any new funds beyond what is already settled on-chain, effectively performing a "griefing" attack. This undermines the integrity of the channel's cooperative close mechanism, as the channel is closed under false pretenses — the server accepts a voucher that does not represent any new economic commitment from the counterparty. There is no confidentiality or availability impact; the primary consequence is a high-integrity violation affecting the financial logic of affected payment channels (GitHub Advisory, wevm Security Advisory).

No public exploit code or evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.026% (2nd percentile), indicating a low near-term exploitation probability (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution is available. However, the attack requires no authentication, no privileges, and no user interaction, making it trivially exploitable by any party with network access to a vulnerable mppx server instance and knowledge of the on-chain settled amount.

1. Reconnaissance: Identify a target running a vulnerable version of mppx (< 0.4.11) with an active tempo/session payment channel. Query the blockchain to determine the current on-chain settled amount for the target channel.
2. Craft the close voucher: Construct a close voucher with cumulativeAmount set exactly equal to the on-chain settled amount. Sign the voucher with a valid test or attacker-controlled key as required by the protocol.
3. Submit the voucher: Send the crafted close credential to the server's verify endpoint with action: 'close' and the matching channelId and cumulativeAmount.
4. Bypass validation: Because the server checks voucher.cumulativeAmount < minCloseAmount (strict less-than), the equal value passes validation without triggering an error.
5. Channel closed for free: The server accepts the voucher and closes the channel cooperatively, without the attacker having committed any new funds beyond what was already settled on-chain, achieving a griefing outcome (GitHub Commit, wevm Security Advisory).

• Logs: Server-side logs showing a cooperative close request accepted where cumulativeAmount equals the on-chain settled amount for a given channelId; absence of a corresponding error message such as close voucher amount must be > in session logs.
• Network: Unexpected or unsolicited close voucher submissions to the mppx server's verify endpoint, particularly from parties not expected to initiate a cooperative close.
• Application State: Payment channels that transition to a closed state without any corresponding increase in cumulative funds committed by the counterparty beyond the previously settled on-chain amount.

Upgrade mppx to version 0.4.11 or later, which corrects the comparison operator in src/tempo/server/Session.ts to reject close vouchers with cumulativeAmount <= onChain.settled. No configuration-based workarounds are available for this vulnerability. Operators should treat this as a priority patch given the zero-privilege, network-accessible nature of the flaw (GitHub Advisory, mppx Release).

The vulnerability was credited to researchers samczsun and veria-labs as finders, both of whom are recognized in the blockchain/Web3 security community. No broader media coverage or notable public commentary beyond the official advisory has been identified (wevm Security Advisory).