GHSA-qr2g-p6q7-w82m: @x402/svm X402 SDK Security Advisory Vulnerability

HIGH
Share
Published
Advisory Summary

GHSA-qr2g-p6q7-w82m is a HIGH x402 sdk security advisory vulnerability (General Security Weakness) affecting @x402/svm libraries in the npm ecosystem. The issue involves x402 sdk security advisory. Remediation is available by upgrading affected packages to version 2.6.0, 2.3.0, 2.5.0.

GHSA-qr2g-p6q7-w82m at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-qr2g-p6q7-w82m
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product @x402/svm
Package Ecosystem npm
Published Date
Last Updated

How to Fix GHSA-qr2g-p6q7-w82m

To remediate this vulnerability, upgrade all affected @x402/svm dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

@x402/svm fixed: 2.6.0 
npm install @x402/svm@2.6.0
x402 fixed: 2.3.0 
pip install x402>=2.3.0
github.com/coinbase/x402/go fixed: 2.5.0 
Upgrade github.com/coinbase/x402/go to 2.5.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls @x402/svm

How to Check if You Are Affected

To determine whether your Node.js application is affected by GHSA-qr2g-p6q7-w82m, inspect your project dependencies using npm:

npm ls @x402/svm

Analyze the terminal output to locate any version of @x402/svm in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.6.0), your application is affected.

Note: The npm ls @x402/svm command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In @x402/svm, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact A security vulnerability exists in outdated versions of the x402 SDK. This vulnerability does not affect users' private keys, smart contracts, or funds. The issue impacts resource servers accepting payments on Solana when the facilitator is running a vulnerable version of the x402 SDK. ### Who Should Take Action Facilitators that process payments on Solana must upgrade the x402 SDK to the patched versions listed below. Clients are not required to upgrade. Resource servers are not required to upgrade unless they operate their own facilitator (self-facilitate). ### Patches Please update to the following package versions: * Npm: @x402/svm >= 2.6.0 * Pypi: x402 >= 2.3.0 * Go: x402 >= 2.5.0

GHSA-qr2g-p6q7-w82m Affected @x402/svm Versions

3 component(s)
Fixed Versions:
2.6.02.3.02.5.0
Product / Package Ecosystem Affected Versions Fixed Version
@x402/svm
npm/@x402/svm
npm
< 2.6.0
2.6.0
x402
pypi/x402
PyPI
< 2.3.0
2.3.0
github.com/coinbase/x402/go
golang/github.com/coinbase/x402/go
Go
< 2.5.0
2.5.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/coinbase/x402/security/advisories/GHSA-qr2g-p6q7-w82m
GitHub Advisory / Wiki ADVISORY
https://github.com/x402-foundation/x402/security/advisories/GHSA-qr2g-p6q7-w82m
@x402/svm Source Repository REPOSITORY
https://github.com/coinbase/x402

Frequently Asked Questions

What is GHSA-qr2g-p6q7-w82m?
GHSA-qr2g-p6q7-w82m is a security vulnerability in @x402/svm involving x402 SDK Security Advisory under General Security Weakness.
Which @x402/svm versions are affected?
Affected versions include releases prior to 2.6.0, 2.3.0, 2.5.0 across affected packages: @x402/svm, x402, github.com/coinbase/x402/go.
What version fixes GHSA-qr2g-p6q7-w82m?
Upgrading to 2.6.0, 2.3.0, 2.5.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is @x402/svm affected?
Yes, @x402/svm is affected in releases prior to 2.6.0. Upgrade your dependency to 2.6.0 or later.
Is x402 affected?
Yes, x402 is affected in releases prior to 2.3.0. Upgrade your dependency to 2.3.0 or later.
What CWE is associated with GHSA-qr2g-p6q7-w82m?
GHSA-qr2g-p6q7-w82m is classified under General Security Weakness.
How can I check npm dependencies for GHSA-qr2g-p6q7-w82m?
Run the dependency tree command: 'npm ls @x402/svm'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qr2g-p6q7-w82m",
  "modified" : "2026-04-08T11:55:22Z",
  "published" : "2026-03-07T02:37:47Z",
  "aliases" : [ ],
  "summary" : "x402 SDK Security Advisory",
  "details" : "### Impact\n\nA security vulnerability exists in outdated versions of the x402 SDK.\n\nThis vulnerability does not affect users' private keys, smart contracts, or funds.\n\nThe issue impacts resource servers accepting payments on Solana when the facilitator is running a vulnerable version of the x402 SDK.\n\n### Who Should Take Action\n\nFacilitators that process payments on Solana must upgrade the x402 SDK to the patched versions listed below.\n\nClients are not required to upgrade.\n\nResource servers are not required to upgrade unless they operate their own facilitator (self-facilitate).\n\n### Patches\n\nPlease update to the following package versions:\n* Npm: @x402/svm >= 2.6.0\n* Pypi: x402 >= 2.3.0\n* Go: x402 >= 2.5.0",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@x402/svm"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.6.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "x402"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.3.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/coinbase/x402/go"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.5.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/coinbase/x402/security/advisories/GHSA-qr2g-p6q7-w82m"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/x402-foundation/x402/security/advisories/GHSA-qr2g-p6q7-w82m"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/coinbase/x402"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-07T02:37:47Z",
    "nvd_published_at" : null
  }
}