CVE-2026-63628

Received Received - Intake

Gas Fee Inflation via Malicious Access List in mppx

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied access_list from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume intrinsic gas even when the listed addresses are never used, a client could add fabricated address-only entries and cause the server fee_payer wallet to pay unnecessary transaction fees. The demonstrated 180-entry list remained within the 500,000 gas policy cap, 16 KB header limit, and RPC simulation budget while increasing the fee by approximately 9.4 times. This issue is fixed in version 0.8.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-63628

EUVD

EUVD-2026-84806

Affected Vendors & Products

Vendor	Product	Version / Range
wevm	mppx	to 0.8.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability in mppx (versions > 0.8.1) involves a fee-payer server copying a client-supplied access list without validating its contents. Attackers can exploit this by submitting transactions with large fabricated access lists, which increase intrinsic gas costs even if unused. The server pays these inflated fees while staying within policy limits.

Detection Guidance

Monitor for unusually high gas fees or transactions with large access lists. Check mppx logs for fee-payer transactions with non-canonical formats or excessive access list entries. Use network monitoring tools to detect abnormal transaction patterns.

Impact Analysis

If you run a fee-payer server using mppx versions > 0.8.1, attackers could drain your gas fees by submitting transactions with excessive access list entries. This increases your operational costs without providing additional value. The attack remains within standard policy limits, making it harder to detect.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. The issue involves inflated transaction fees due to improper validation of access lists in fee-payer transactions, which is a financial and operational risk rather than a data privacy or security compliance concern.

Mitigation Strategies

Upgrade mppx to version 0.8.2 or later. Implement strict validation for fee-payer transactions to reject non-canonical formats. Review and restrict access list sizes in transactions. Monitor for and block suspicious transactions with fabricated access lists.

Hi! I’m here to help you understand CVE-2026-63628. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70