@x402/extensions vulnerabilities

CVEs whose affected-version data names the @x402/extensions package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-113603Medium· 6.5

yesterday

x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource

The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid rout…

▾ Sunlitx402-foundation · @x402/extensionsEPSS 0.29%via CVEORG