GHSA-3j63-5h8p-gf7c: 
JavaScript vulnerability analysis and mitigation

A high-severity security vulnerability was identified in outdated versions of the x402 SDK and its associated packages (x402-express, x402-hono, x402-next). The vulnerability was discovered and disclosed on August 20, 2025, affecting all versions below 0.5.2 of these packages (GitHub Advisory).

The vulnerability is tracked as GHSA-3j63-5h8p-gf7c and has been assigned a high severity rating. The affected packages include x402, x402-express, x402-hono, and x402-next, all in versions prior to 0.5.2. No specific Common Weakness Enumeration (CWE) categories have been associated with this vulnerability, and no CVE ID has been assigned (GitHub Advisory).

According to the advisory, the vulnerability primarily affects builders working on resource servers. Importantly, it does not directly impact users' keys, smart contracts, or funds (GitHub Advisory).

The vulnerability has been patched in version 0.5.2 of all affected packages. Users are advised to update to the following minimum versions: x402 >= 0.5.2, x402-next >= 0.5.2, x402-express >= 0.5.2, and x402-hono >= 0.5.2 (GitHub Advisory).