GHSA-3j63-5h8p-gf7c
x402 SDK vulnerable in outdated versions in resource servers for builders
Impact
There is a security vulnerability in outdated versions of the x402 SDK. This does not directly affect users' keys, smart contracts, or funds.
This primarily impacts builders working on resource servers.
Patches
Please update to the following package versions:
- x402 >= 0.5.2
- x402-next >= 0.5.2
- x402-express >= 0.5.2
- x402-hono >= 0.5.2
What each source reports
GitHub AdvisoriesNo score
x402 SDK vulnerable in outdated versions in resource servers for builders
Impact
There is a security vulnerability in outdated versions of the x402 SDK. This does not directly affect users' keys, smart contracts, or funds.
This primarily impacts builders working on resource servers.
Patches
Please update to the following package versions:
- x402 >= 0.5.2
- x402-next >= 0.5.2
- x402-express >= 0.5.2
- x402-hono >= 0.5.2
- Record
GHSA-3j63-5h8p-gf7c- Updated
- 2026-11-02
OSVNo score
x402 SDK vulnerable in outdated versions in resource servers for builders
Impact
There is a security vulnerability in outdated versions of the x402 SDK. This does not directly affect users' keys, smart contracts, or funds.
This primarily impacts builders working on resource servers.
Patches
Please update to the following package versions:
- x402 >= 0.5.2
- x402-next >= 0.5.2
- x402-express >= 0.5.2
- x402-hono >= 0.5.2
- Record
GHSA-3j63-5h8p-gf7c- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
x402npm | before 0.5.2 | 0.5.2 |
x402-nextnpm | before 0.5.2 | 0.5.2 |
x402-expressnpm | before 0.5.2 | 0.5.2 |
x402-hononpm | before 0.5.2 | 0.5.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-3j63-5h8p-gf7c is a vulnerability with no CVSS score yet in x402, published August 20, 2025. No source lists public exploit code. Fixed in x402 0.5.2.