CVE-2026-34210

Description

### Impact The `stripe/charge` payment method did not check Stripe's `Idempotent-Replayed` response header when creating PaymentIntents. An attacker could replay a valid credential containing the same `spt` token against a new challenge, and the server would accept the replayed Stripe PaymentIntent as a new successful payment without actually charging the customer again. This allowed an attacker to pay once and consume unlimited resources by replaying the credential. ### Patches Fixed in 0.4.11. The server now checks the `Idempotent-Replayed` header and rejects replayed PaymentIntents. ### Workarounds There are no workarounds available for this vulnerability.

How to fix CVE-2026-34210

To remediate CVE-2026-34210, upgrade the affected package to a fixed version below.

• —upgrade to 0.4.11 or later

Is CVE-2026-34210 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 0.4.11

CVSS scores

References (6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-34210
• PATCHgithub.com/wevm/mppx
• WEBgithub.com/wevm/mppx/commit/b2b1a0b60506fc71aa80b8a025084949dca1a994
• WEBgithub.com/wevm/mppx/releases/tag/[email protected]
• WEB