{"id":"GHSA-3j63-5h8p-gf7c","aliases":[],"status":"published","title":"x402 SDK vulnerable in outdated versions in resource servers for builders","description":"### Impact\nThere is a security vulnerability in outdated versions of the x402 SDK. This does not directly affect users' keys, smart contracts, or funds.\n\nThis primarily impacts builders working on resource servers.\n\n### Patches\nPlease update to the following package versions:\n* x402 \u003e= 0.5.2\n* x402-next \u003e= 0.5.2\n* x402-express \u003e= 0.5.2\n* x402-hono \u003e= 0.5.2","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-08-20T20:51:55Z","modified":"2025-08-20T20:51:56Z","fixes":[{"ecosystem":"npm","package":"x402","fixed_in":["0.5.2"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"x402-next","fixed_in":["0.5.2"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"x402-express","fixed_in":["0.5.2"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"x402-hono","fixed_in":["0.5.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"x402","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"x402-next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"x402-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"x402-hono","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2"}]}]},{"source":"osv","ecosystem":"npm","package":"x402","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.2"}]}]},{"source":"osv","ecosystem":"npm","package":"x402-next","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.2"}]}]},{"source":"osv","ecosystem":"npm","package":"x402-express","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.2"}]}]},{"source":"osv","ecosystem":"npm","package":"x402-hono","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.2"}]}]}],"references":[{"url":"https://github.com/coinbase/x402/security/advisories/GHSA-3j63-5h8p-gf7c","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3j63-5h8p-gf7c"},{"url":"https://github.com/coinbase/x402","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-3j63-5h8p-gf7c","title":"x402 SDK vulnerable in outdated versions in resource servers for builders","description":"### Impact\nThere is a security vulnerability in outdated versions of the x402 SDK. This does not directly affect users' keys, smart contracts, or funds.\n\nThis primarily impacts builders working on resource servers.\n\n### Patches\nPlease update to the following package versions:\n* x402 \u003e= 0.5.2\n* x402-next \u003e= 0.5.2\n* x402-express \u003e= 0.5.2\n* x402-hono \u003e= 0.5.2","status":"published","published":"2025-08-20T20:51:55Z","modified":"2025-08-20T20:51:56Z","updated_at":"2026-11-02T14:38:54.795089Z"}],"osv":[{"id":"GHSA-3j63-5h8p-gf7c","title":"x402 SDK vulnerable in outdated versions in resource servers for builders","description":"### Impact\nThere is a security vulnerability in outdated versions of the x402 SDK. This does not directly affect users' keys, smart contracts, or funds.\n\nThis primarily impacts builders working on resource servers.\n\n### Patches\nPlease update to the following package versions:\n* x402 \u003e= 0.5.2\n* x402-next \u003e= 0.5.2\n* x402-express \u003e= 0.5.2\n* x402-hono \u003e= 0.5.2","status":"published","published":"2025-08-20T20:51:55Z","modified":"2025-08-20T20:51:55Z","updated_at":"2026-11-02T15:46:35.747385Z"}]}}