{"id":"EUVD-2026-84805","revision":null,"records":[{"revision":"d509937ac40f41d8ba2ca1fec53e90fb","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-63627","aliases":[],"title":"mppx: Gas Draining with padding","description":"mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored calldata but did not reject trailing bytes. A client could append nonzero padding that increased intrinsic calldata gas while gas_limit and max_fee_per_gas remained within policy caps, causing the server fee_payer wallet to pay substantially more than the decoded transaction required. The tested 16 KB header limit bounded the demonstrated padding to about 5,500 bytes and produced approximately five times the normal transaction fee. This issue is fixed in version 0.8.2.","state":0,"publishedAt":"2026-09-22T19:07:02.984+00:00","modifiedAt":"2026-09-23T14:36:37.154+00:00","affected":[{"ecosystem":"Vendor product","name":"mppx","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"wevm\",\n                    \"product\": \"mppx\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.8.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.9,"severity":"MEDIUM"}],"references":["https://github.com/wevm/mppx/security/advisories/GHSA-727h-3vm5-qwq6","https://github.com/wevm/mppx/pull/602","https://github.com/wevm/mppx/commit/24ddcca719ae282977d8747309ed1275ea282b25","https://github.com/wevm/mppx/releases/tag/mppx@0.8.2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63627","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-63627","identifiers":["CVE-2026-63627"]},"retained":false,"historicalAffected":[]},{"revision":"79bc7d599cfb4e5f86004a681f04c44d","observedAt":"2026-11-11T15:06:38.038+00:00","statement":{"source":"euvd","id":"EUVD-2026-84805","aliases":["CVE-2026-63627","GHSA-727h-3vm5-qwq6"],"title":"mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored calldata but did not reject trailing bytes. A client could app…","description":"mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored calldata but did not reject trailing bytes. A client could append nonzero padding that increased intrinsic calldata gas while gas_limit and max_fee_per_gas remained within policy caps, causing the server fee_payer wallet to pay substantially more than the decoded transaction required. The tested 16 KB header limit bounded the demonstrated padding to about 5,500 bytes and produced approximately five times the normal transaction fee. This issue is fixed in version 0.8.2.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.9,"severity":null}],"references":["https://github.com/wevm/mppx/security/advisories/GHSA-727h-3vm5-qwq6","https://github.com/wevm/mppx/pull/602","https://github.com/wevm/mppx/commit/24ddcca719ae282977d8747309ed1275ea282b25","https://github.com/wevm/mppx/releases/tag/mppx@0.8.2"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84805","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 22, 2026, 7:07:02 PM","dateUpdated":"Sep 23, 2026, 2:36:37 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-84805","identifiers":["EUVD-2026-84805","CVE-2026-63627","GHSA-727h-3vm5-qwq6"]},"retained":false,"historicalAffected":[]},{"revision":"3c9e5d4267f0409b96bfdc2259eebf58","observedAt":"2026-10-25T15:18:45.851+00:00","statement":{"source":"nvd","id":"CVE-2026-63627","aliases":[],"title":"mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored calldata but did not reject trailing bytes. A client could app…","description":"mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored calldata but did not reject trailing bytes. A client could append nonzero padding that increased intrinsic calldata gas while gas_limit and max_fee_per_gas remained within policy caps, causing the server fee_payer wallet to pay substantially more than the decoded transaction required. The tested 16 KB header limit bounded the demonstrated padding to about 5,500 bytes and produced approximately five times the normal transaction fee. This issue is fixed in version 0.8.2.","state":0,"publishedAt":"2026-09-22T20:17:04.763+00:00","modifiedAt":"2026-09-23T18:12:04.247+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.9,"severity":"MEDIUM"}],"references":["https://github.com/wevm/mppx/commit/24ddcca719ae282977d8747309ed1275ea282b25","https://github.com/wevm/mppx/pull/602","https://github.com/wevm/mppx/releases/tag/mppx@0.8.2","https://github.com/wevm/mppx/security/advisories/GHSA-727h-3vm5-qwq6"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63627","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-20"],"productCriteria":[],"sourceDates":{"published":"2026-09-22T20:17:04.763","lastModified":"2026-09-23T18:12:04.247"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-63627","identifiers":["CVE-2026-63627"]},"retained":false,"historicalAffected":[]},{"revision":"e5cc3d5c20af46759763eb0900d32972","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-727h-3vm5-qwq6","aliases":["CVE-2026-63627"],"title":"mppx: Gas Draining with padding","description":"### Details\nWhen the server acts as the fee_payer, `mppx` 0.6.27 validates calldata using viem's `decodeFunctionData`, which is lenient about trailing bytes. The `FeePayerPolicy` caps `gas_limit` (≤ 2 M) and `max_fee_per_gas` (≤ 100 Gwei) but does **not** check calldata length.\n\nTempo uses legacy calldata gas pricing: **16 gas per non-zero byte**. Appending `N` bytes of `0x01` padding inflates actual gas used by `N × 16` while keeping `gas_limit` and `max_fee_per_gas` within policy caps. The server cosigns and broadcasts the padded transaction, draining its fee-payer wallet.\n\n**Vulnerable code path:** `FeePayerPolicy` in `fee-payer.ts` (mppx 0.6.27) enforces `maxGas = 2_000_000` and `maxFeePerGas = 100 Gwei` but has no `calldata.length` bound. The policy check passes because the inflated gas comes from intrinsic calldata cost, not the declared `gas_limit`.\n\n**Note:** In the experiment, a 16 KB `max_header_length` is enforced, which caps the maximum effective padding at roughly 5,500 bytes. The default padding in this PoC (5,500 bytes) is within that limit.\n\n### PoC\nThe PoC is provided below. It is configured to reproduce the attack on Tempo Moderate testnet within a Docker environment. Download the PoC and run:\n```bash\nunzip mppx_typescript_PoC.zip\ncd mppx_typescript\ndocker build -t mppx-padding .\ndocker run --rm mppx-padding\n``` \nThere are more details in `mppx_typescript/README.md`\n\n### Impact\nA malicious client can force the server to pay ~**5x** the normal transaction fee. This dramatically increases operational costs and completely destroys the profit margin on low-cost items.\n\nPlease provide a way to share the PoC in .zip format to you. Thank you!","state":0,"publishedAt":"2026-09-22T20:34:17+00:00","modifiedAt":"2026-09-22T21:00:04.733697+00:00","affected":[{"ecosystem":"npm","name":"mppx","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.8.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/wevm/mppx/security/advisories/GHSA-727h-3vm5-qwq6","https://github.com/wevm/mppx/pull/602","https://github.com/wevm/mppx/commit/24ddcca719ae282977d8747309ed1275ea282b25","https://github.com/wevm/mppx","https://github.com/wevm/mppx/releases/tag/mppx@0.8.2"],"sourceUrl":"https://github.com/advisories/GHSA-727h-3vm5-qwq6","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-727h-3vm5-qwq6","identifiers":["GHSA-727h-3vm5-qwq6","CVE-2026-63627"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T18:18:51.9610599+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T18:18:51.9610599+00:00","lastSuccessAt":"2026-11-12T18:18:52.1359793+00:00","error":null,"lastVerifiedAt":"2026-11-12T18:18:52.1359803+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-436983018a0f2d42a11c05b3b04ba98c8ad3664129731f383f79e8cf6a19e2f9","complete":true,"records":424774,"lastAttemptAt":"2026-11-12T18:16:42.0266239+00:00","lastSuccessAt":"2026-11-12T18:16:41.2671502+00:00","error":null,"lastVerifiedAt":"2026-11-12T18:16:42.0266239+00:00","snapshotPublishedAt":"2026-11-12T17:19:00+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-a6bc4e59bf274de6bccd2bd795defd8b","complete":true,"records":13775,"lastAttemptAt":"2026-11-12T18:19:15.1587038+00:00","lastSuccessAt":"2026-11-12T18:19:15.154+00:00","error":null,"lastVerifiedAt":"2026-11-12T18:19:15.154+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13828,"expectedIdentifiers":13828,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T18:18:51.9610599+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-12T18:18:51.9610599+00:00","lastSuccessAt":"2026-11-12T18:18:54.878817+00:00","error":null,"lastVerifiedAt":"2026-11-12T18:18:54.8788175+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c74733ed0c2f4bb3aa28f2921b528eb9","complete":true,"records":13775,"lastAttemptAt":"2026-11-12T18:19:14.2859916+00:00","lastSuccessAt":"2026-11-12T18:19:14.282+00:00","error":null,"lastVerifiedAt":"2026-11-12T18:19:14.282+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13828,"expectedIdentifiers":13828,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T18:18:51.9148238+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T18:18:51.9148238+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-4d60731753a2f72e455d1086e7203d0ef10843936dcc1cf2b45135e2caa204b0","complete":true,"records":2012,"lastAttemptAt":"2026-11-12T18:16:50.9322629+00:00","lastSuccessAt":"2026-11-12T18:16:50.7862525+00:00","error":null,"lastVerifiedAt":"2026-11-12T18:16:50.9322629+00:00","snapshotPublishedAt":"2026-11-12T17:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-0d57668ba92a2918d0664e89ea91d467f8e6a2bc6330923eb883b74ac42a14ec","complete":true,"records":3125,"lastAttemptAt":"2026-11-12T18:18:51.9276914+00:00","lastSuccessAt":"2026-11-12T15:18:36.6112732+00:00","error":null,"lastVerifiedAt":"2026-11-12T18:18:51.9276914+00:00","snapshotPublishedAt":"2026-11-12T14:48:37+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-5f552124b4be907bc00a2f540b60dd82b393dc198845ddee9ca4af23654583f8","complete":true,"records":231722,"lastAttemptAt":"2026-11-12T18:18:51.6701113+00:00","lastSuccessAt":"2026-11-12T18:18:50.0151941+00:00","error":null,"lastVerifiedAt":"2026-11-12T18:18:51.6701113+00:00","snapshotPublishedAt":"2026-11-12T17:33:22+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}