mppx has Stripe charge credential replay via missing idempotency check
Impact
The stripe/charge payment method did not check Stripe's Idempotent-Replayed response header when creating PaymentIntents. An attacker could replay a valid credential containing the same spt token against a new challenge, and the server would accept the replayed Stripe PaymentIntent as a new successful payment without actually charging the customer again. This allowed an attacker to pay once and consume unlimited resources by replaying the credential.
Patches
Fixed in 0.4.11. The server now checks the Idempotent-Replayed header and rejects replayed PaymentIntents.
Workarounds
There are no workarounds available for this vulnerability.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | mppx | < 0.4.11 | 0.4.11 |
References
- https://github.com/wevm/mppx/security/advisories/GHSA-8mhj-rffc-rcvw
- https://nvd.nist.gov/vuln/detail/CVE-2026-34210
- https://github.com/wevm/mppx/commit/b2b1a0b60506fc71aa80b8a025084949dca1a994
- https://github.com/wevm/mppx
- https://github.com/wevm/mppx/releases/tag/mppx%400.4.11
- https://github.com/wevm/mppx/releases/tag/mppx@0.4.11
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-697- Platform
- npm
- Package
mppx- Disclosed
- 29.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-8mhj-rffc-rcvw - CC BY 4.0
Vulnerability history: mppx
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 03.2026 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 1
- Medium 3
Disclosures per year
- 2026: 5
-
mppx has Stripe charge credential replay via missing idempotency check this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.