Skip to content
Fencer Intel
high —

GHSA-qr2g-p6q7-w82m json

x402 SDK Security Advisory

published 8mo ago modified 7mo ago also GO-2026-4647

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact

A security vulnerability exists in outdated versions of the x402 SDK.

This vulnerability does not affect users' private keys, smart contracts, or funds.

The issue impacts resource servers accepting payments on Solana when the facilitator is running a vulnerable version of the x402 SDK.

### Who Should Take Action

Facilitators that process payments on Solana must upgrade the x402 SDK to the patched versions listed below.

Clients are not required to upgrade.

Resource servers are not required to upgrade unless they operate their own facilitator (self-facilitate).

### Patches

Please update to the following package versions: * Npm: @x402/svm >= 2.6.0 * Pypi: x402 >= 2.3.0 * Go: x402 >= 2.5.0

Patch / fix

  • npm @x402/svm 2.6.0
  • pypi x402 2.3.0
  • go github.com/coinbase/x402/go 2.5.0

Is GHSA-qr2g-p6q7-w82m in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
npm @x402/svm
<2.6.0
2.6.0
pypi x402
<2.3.0
2.3.0
go github.com/coinbase/x402/go
<2.5.0
all versions
2.5.0

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.