{
  "schema_version": "1",
  "generated_at": "2026-10-24T00:00:00Z",
  "disclaimer": {
    "text": "Not investment advice.",
    "url": "https://agentpaywire.com/disclaimer.json"
  },
  "description": "Minimum versions stated by a linked source. advisory_url is null when the source says no formal advisory was published. minimum_safe_version is null when the source names a fix and does not name a version. The four @x402 rows are the packages The Hacker News names. Other @x402 packages are not given a minimum here.",
  "markdown_url": "https://agentpaywire.com/api/sdk-security.md",
  "csv_url": "https://agentpaywire.com/api/sdk-security.csv",
  "count": 6,
  "entries": [
    {
      "id": "x402-fetch",
      "package": "@x402/fetch",
      "ecosystem": "npm",
      "minimum_safe_version": "2.23.0",
      "constraint": ">=2.23.0",
      "per_payment_cap_usd": 1,
      "per_payment_cap_scope": "per payment",
      "default_recognized_stablecoins_only": true,
      "spend_controls_opt_out": "spendControls: false",
      "formal_advisory_published": false,
      "advisory_url": null,
      "reported_at": "2026-08-12",
      "fixed_at": "2026-08-20",
      "origin_header_rejected_since": null,
      "fixes": null,
      "notes": "V12 (2026-10-22) reports 25 vulnerabilities, including three critical findings reported 2026-08-12 and fixed by 2026-08-20. The Hacker News (2026-10-23) says the fixes are in this package at 2.23.0 or later, that patched clients cap each payment at $1 and accept only recognized stablecoins by default, and that spendControls: false disables that cap. The same article says no formal security advisory was published. This row does not state a minimum for other @x402 packages.",
      "source": "https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html",
      "related_urls": [
        "https://v12.sh/blog/x402"
      ],
      "verified_at": "2026-10-24"
    },
    {
      "id": "x402-axios",
      "package": "@x402/axios",
      "ecosystem": "npm",
      "minimum_safe_version": "2.23.0",
      "constraint": ">=2.23.0",
      "per_payment_cap_usd": 1,
      "per_payment_cap_scope": "per payment",
      "default_recognized_stablecoins_only": true,
      "spend_controls_opt_out": "spendControls: false",
      "formal_advisory_published": false,
      "advisory_url": null,
      "reported_at": "2026-08-12",
      "fixed_at": "2026-08-20",
      "origin_header_rejected_since": null,
      "fixes": null,
      "notes": "V12 (2026-10-22) reports 25 vulnerabilities, including three critical findings reported 2026-08-12 and fixed by 2026-08-20. The Hacker News (2026-10-23) says the fixes are in this package at 2.23.0 or later, that patched clients cap each payment at $1 and accept only recognized stablecoins by default, and that spendControls: false disables that cap. The same article says no formal security advisory was published. This row does not state a minimum for other @x402 packages.",
      "source": "https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html",
      "related_urls": [
        "https://v12.sh/blog/x402"
      ],
      "verified_at": "2026-10-24"
    },
    {
      "id": "x402-extensions",
      "package": "@x402/extensions",
      "ecosystem": "npm",
      "minimum_safe_version": "2.23.0",
      "constraint": ">=2.23.0",
      "per_payment_cap_usd": 1,
      "per_payment_cap_scope": "per payment",
      "default_recognized_stablecoins_only": true,
      "spend_controls_opt_out": "spendControls: false",
      "formal_advisory_published": false,
      "advisory_url": null,
      "reported_at": "2026-08-12",
      "fixed_at": "2026-08-20",
      "origin_header_rejected_since": null,
      "fixes": null,
      "notes": "V12 (2026-10-22) reports 25 vulnerabilities, including three critical findings reported 2026-08-12 and fixed by 2026-08-20. The Hacker News (2026-10-23) says the fixes are in this package at 2.23.0 or later, that patched clients cap each payment at $1 and accept only recognized stablecoins by default, and that spendControls: false disables that cap. The same article says no formal security advisory was published. This row does not state a minimum for other @x402 packages.",
      "source": "https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html",
      "related_urls": [
        "https://v12.sh/blog/x402"
      ],
      "verified_at": "2026-10-24"
    },
    {
      "id": "x402-svm",
      "package": "@x402/svm",
      "ecosystem": "npm",
      "minimum_safe_version": "2.23.0",
      "constraint": ">=2.23.0",
      "per_payment_cap_usd": 1,
      "per_payment_cap_scope": "per payment",
      "default_recognized_stablecoins_only": true,
      "spend_controls_opt_out": "spendControls: false",
      "formal_advisory_published": false,
      "advisory_url": null,
      "reported_at": "2026-08-12",
      "fixed_at": "2026-08-20",
      "origin_header_rejected_since": null,
      "fixes": null,
      "notes": "V12 (2026-10-22) reports 25 vulnerabilities, including three critical findings reported 2026-08-12 and fixed by 2026-08-20. The Hacker News (2026-10-23) says the fixes are in this package at 2.23.0 or later, that patched clients cap each payment at $1 and accept only recognized stablecoins by default, and that spendControls: false disables that cap. The same article says no formal security advisory was published. This row does not state a minimum for other @x402 packages.",
      "source": "https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html",
      "related_urls": [
        "https://v12.sh/blog/x402"
      ],
      "verified_at": "2026-10-24"
    },
    {
      "id": "eclair",
      "package": "eclair",
      "ecosystem": "github",
      "minimum_safe_version": "0.14.5",
      "constraint": ">=0.14.5",
      "per_payment_cap_usd": null,
      "per_payment_cap_scope": null,
      "default_recognized_stablecoins_only": null,
      "spend_controls_opt_out": null,
      "formal_advisory_published": null,
      "advisory_url": "https://github.com/ACINQ/eclair/releases/tag/v0.14.5",
      "reported_at": null,
      "fixed_at": "2026-10-20",
      "origin_header_rejected_since": "0.14.4",
      "fixes": "Optech #428 says 0.14.5 fixes trampoline-routing and taproot-splicing fund-theft vulnerabilities and an onion payload length overflow. The GitHub release says the patch contains security hardening fixes that malicious nodes could exploit.",
      "notes": "The GitHub release published 2026-10-20 says upgrading is strongly recommended and that the release is compatible without closing channels. Optech #428 says 0.14.4 rejects API requests that carry an Origin header, so browser integrations must call Eclair from their own backend. No CVE or formal advisory id is stated on those pages. formal_advisory_published is null because those pages do not say whether a separate advisory exists.",
      "source": "https://github.com/ACINQ/eclair/releases/tag/v0.14.5",
      "related_urls": [
        "https://bitcoinops.org/en/newsletters/2026/10/23/",
        "https://github.com/ACINQ/eclair/blob/master/docs/release-notes/eclair-v0.14.5.md",
        "https://github.com/ACINQ/eclair/releases/tag/v0.14.4"
      ],
      "verified_at": "2026-10-24"
    },
    {
      "id": "btcpay-server",
      "package": "BTCPay Server",
      "ecosystem": "github",
      "minimum_safe_version": null,
      "constraint": null,
      "per_payment_cap_usd": null,
      "per_payment_cap_scope": null,
      "default_recognized_stablecoins_only": null,
      "spend_controls_opt_out": null,
      "formal_advisory_published": null,
      "advisory_url": "https://bitcoinops.org/en/newsletters/2026/10/23/",
      "reported_at": null,
      "fixed_at": null,
      "origin_header_rejected_since": null,
      "fixes": "Duplicate Lightning payouts and Greenfield API key scope escalation.",
      "notes": "Bitcoin Optech Newsletter #428 reports BTCPay Server fixes for duplicate Lightning payouts and Greenfield API key scope escalation. That newsletter does not name a release version. minimum_safe_version and constraint are null. The version is unverified.",
      "source": "https://bitcoinops.org/en/newsletters/2026/10/23/",
      "related_urls": [],
      "verified_at": "2026-10-24"
    }
  ],
  "$schema": "https://agentpaywire.com/schemas/sdk-security.schema.json"
}