{"id":"GHSA-qr2g-p6q7-w82m","aliases":["GO-2026-4647"],"status":"published","title":"x402 SDK Security Advisory","description":"### Impact\n\nA security vulnerability exists in outdated versions of the x402 SDK.\n\nThis vulnerability does not affect users' private keys, smart contracts, or funds.\n\nThe issue impacts resource servers accepting payments on Solana when the facilitator is running a vulnerable version of the x402 SDK.\n\n### Who Should Take Action\n\nFacilitators that process payments on Solana must upgrade the x402 SDK to the patched versions listed below.\n\nClients are not required to upgrade.\n\nResource servers are not required to upgrade unless they operate their own facilitator (self-facilitate).\n\n### Patches\n\nPlease update to the following package versions:\n* Npm: @x402/svm \u003e= 2.6.0\n* Pypi: x402 \u003e= 2.3.0\n* Go: x402 \u003e= 2.5.0","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-03-07T02:37:47Z","modified":"2026-04-08T12:08:26Z","fixes":[{"ecosystem":"npm","package":"@x402/svm","fixed_in":["2.6.0"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"x402","fixed_in":["2.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/coinbase/x402/go","fixed_in":["2.5.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@x402/svm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"x402","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/coinbase/x402/go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@x402/svm","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"x402","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.4","0.1.5","0.2.0","0.2.1","0.3.0","1.0.0","2.0.0","2.1.0","2.2.0"]},{"source":"osv","ecosystem":"Go","package":"github.com/coinbase/x402/go","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.5.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/coinbase/x402/go","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"references":[{"url":"https://github.com/coinbase/x402/security/advisories/GHSA-qr2g-p6q7-w82m","tags":["web","advisory"]},{"url":"https://github.com/x402-foundation/x402/security/advisories/GHSA-qr2g-p6q7-w82m","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qr2g-p6q7-w82m"},{"url":"https://github.com/coinbase/x402","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-qr2g-p6q7-w82m","title":"x402 SDK Security Advisory","description":"### Impact\n\nA security vulnerability exists in outdated versions of the x402 SDK.\n\nThis vulnerability does not affect users' private keys, smart contracts, or funds.\n\nThe issue impacts resource servers accepting payments on Solana when the facilitator is running a vulnerable version of the x402 SDK.\n\n### Who Should Take Action\n\nFacilitators that process payments on Solana must upgrade the x402 SDK to the patched versions listed below.\n\nClients are not required to upgrade.\n\nResource servers are not required to upgrade unless they operate their own facilitator (self-facilitate).\n\n### Patches\n\nPlease update to the following package versions:\n* Npm: @x402/svm \u003e= 2.6.0\n* Pypi: x402 \u003e= 2.3.0\n* Go: x402 \u003e= 2.5.0","status":"published","published":"2026-03-07T02:37:47Z","modified":"2026-04-08T11:55:24Z","updated_at":"2026-11-02T14:39:51.193071Z"}],"osv":[{"id":"GHSA-qr2g-p6q7-w82m","title":"x402 SDK Security Advisory","description":"### Impact\n\nA security vulnerability exists in outdated versions of the x402 SDK.\n\nThis vulnerability does not affect users' private keys, smart contracts, or funds.\n\nThe issue impacts resource servers accepting payments on Solana when the facilitator is running a vulnerable version of the x402 SDK.\n\n### Who Should Take Action\n\nFacilitators that process payments on Solana must upgrade the x402 SDK to the patched versions listed below.\n\nClients are not required to upgrade.\n\nResource servers are not required to upgrade unless they operate their own facilitator (self-facilitate).\n\n### Patches\n\nPlease update to the following package versions:\n* Npm: @x402/svm \u003e= 2.6.0\n* Pypi: x402 \u003e= 2.3.0\n* Go: x402 \u003e= 2.5.0","status":"published","published":"2026-03-07T02:37:47Z","modified":"2026-04-08T12:08:26.083461Z","updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"GO-2026-4647","title":"x402 SDK Security Advisory in github.com/coinbase/x402/go","description":"x402 SDK Security Advisory in github.com/coinbase/x402/go.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/coinbase/x402/go before v2.5.0.","status":"published","published":"2026-03-10T18:28:10Z","modified":"2026-03-23T04:52:50.053504Z","updated_at":"2026-11-02T15:47:02.280725Z"}]}}