---
id: CVE-2026-63627
title: mppx is a TypeScript interface for machine payments protocol
summary: >-
  mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2,
  FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to
  validate fee-sponsored calldata but did not reject trailing bytes. A client
  could …
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'
cwe:
  - CWE-20
vendor: wevm
product: mppx
affected:
  - mppx < 0.8.2
patched:
  - mppx 0.8.2
published: '2026-09-22'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T18:12:04.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63627'
references:
  - url: >-
      https://github.com/wevm/mppx/commit/24ddcca719ae282977d8747309ed1275ea282b25
    label: security-advisories@github.com
  - url: 'https://github.com/wevm/mppx/pull/602'
    label: security-advisories@github.com
  - url: 'https://github.com/wevm/mppx/releases/tag/mppx@0.8.2'
    label: security-advisories@github.com
  - url: 'https://github.com/wevm/mppx/security/advisories/GHSA-727h-3vm5-qwq6'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-727h-3vm5-qwq6'
tags:
  - nvd
  - cve.org
  - ghsa
  - npm
epss: 0.00384
epssPercentile: 0.29687
aliases:
  - GHSA-727h-3vm5-qwq6
ecosystem: npm
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-23T14:15:12.714478Z'
cvssSource: cna
ingestedAt: '2026-09-22T20:10:15.111Z'
---

## Overview

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored calldata but did not reject trailing bytes. A client could append nonzero padding that increased intrinsic calldata gas while gas_limit and max_fee_per_gas remained within policy caps, causing the server fee_payer wallet to pay substantially more than the decoded transaction required. The tested 16 KB header limit bounded the demonstrated padding to about 5,500 bytes and produced approximately five times the normal transaction fee. This issue is fixed in version 0.8.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-63627)

Affected packages:

- `mppx < 0.8.1`

Patched in:

- `mppx 0.8.2`

Source: https://github.com/advisories/GHSA-727h-3vm5-qwq6