Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

mpp

13 known vulnerabilities (10 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
13 · 10 high, 3 medium
Registry
Hex

Advisories 13

  • mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed

    Affected: from 0.14.0, fixed in 0.16.2; from 0.14.0, fixed in 0.16.2.

  • Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free

    Affected: from 0.14.0, fixed in 0.16.2; from 0.14.0, fixed in 0.16.2.

  • CVE-2026-88255Medium 6.3

    mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a…

    Affected: from 0.2.0, fixed in 0.16.2; from 0.2.0, fixed in 0.16.2.

  • CVE-2026-89186Medium 6.3

    mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid…

    Affected: from 0.1.0, fixed in 0.16.2; from 0.1.0, fixed in 0.16.2.

  • Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation

    Affected: from 0.2.0, fixed in 0.16.1; from 0.2.0, fixed in 0.16.1.

  • Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning

    Affected: from 0.2.0, fixed in 0.16.1; from 0.2.0, fixed in 0.16.1.

  • On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay

    Affected: from 0.3.0, fixed in 0.6.3; from 0.3.0, fixed in 0.6.3.

  • Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain

    Affected: from 0.2.0, fixed in 0.12.0; from 0.2.0, fixed in 0.12.0.

  • Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay

    Affected: from 0.6.1, fixed in 0.6.4; from 0.6.1, fixed in 0.6.4.

  • CVE-2026-73829Medium 6.3

    Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race

    Affected: from 0.2.0, fixed in 0.6.1; from 0.2.0, fixed in 0.6.1.

  • Missing gas_limit validation in mpp Tempo fee-payer enables wallet drain

    Affected: from 0.2.0, fixed in 0.6.0; from 0.2.0, fixed in 0.6.0.

  • Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment

    Affected: from 0.2.0, fixed in 0.6.0; from 0.2.0, fixed in 0.6.0.

  • Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain

    Affected: from 0.2.0, fixed in 0.6.0; from 0.2.0, fixed in 0.6.0.