CVE-2026-34210

The record

mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the stripe/charge payment method did not check Stripe's Idempotent-Replayed response header when creating PaymentIntents. An attacker could replay a valid credential containing the same spt token against a new challenge, and the server would accept the replayed Stripe PaymentIntent as a new successful payment without actually charging the customer again. This allowed an attacker to pay once and consume unlimited resources by replaying the credential. This issue has been patched in version 0.4.11.

Affected packages

Related vulnerabilities

• GHSA-8mhj-rffc-rcvw mppx has Stripe charge credential replay via missing idempotency check Same vulnerability
• CVE-2026-34209 mppx is a TypeScript interface for machine payments protocol. Also affects mppx
• GHSA-8x4m-qw58-3pcx mppx has multiple payment bypass and griefing vulnerabilities Also affects mppx
• GHSA-mv9j-8jvg-j8mr mppx: Tempo has a session close voucher bypass vulnerability due to settled amount… Also affects mppx
• CVE-2026-101913 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in… CWE-697
• CVE-2026-101912 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in… CWE-697
• CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind trusted… CWE-697
• CVE-2026-64836 ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control… CWE-697