CVE-2026-63628

UNKNOWN 0.0

mppx: Gas Draining with access list

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied access_list from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume intrinsic gas even when the listed addresses are never used, a client could add fabricated address-only entries and cause the server fee_payer wallet to pay unnecessary transaction fees. The demonstrated 180-entry list remained within the 500,000 gas policy cap, 16 KB header limit, and RPC simulation budget while increasing the fee by approximately 9.4 times. This issue is fixed in version 0.8.2.

CWE	CWE-20
Vendor	wevm
Product	mppx
Published	Sep 22, 2026

Stay Ahead of the Next One

Get instant alerts for wevm mppx

Be the first to know when new unknown vulnerabilities affecting wevm mppx are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

wevm / mppx

< 0.8.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/wevm/mppx/security/advisories/GHSA-vc9j-9wph-qghj github.com: https://github.com/wevm/mppx/pull/602 github.com: https://github.com/wevm/mppx/commit/24ddcca719ae282977d8747309ed1275ea282b25 github.com: https://github.com/wevm/mppx/releases/tag/[email protected]