# SDK security registry

Minimum versions from a linked source. Null means that source did not state the field. BTCPay Server has no version in Optech #428.

JSON: https://agentpaywire.com/api/sdk-security.json
Disclaimer: https://agentpaywire.com/disclaimer.json

## @x402/fetch

- id: x402-fetch
- ecosystem: npm
- minimum_safe_version: 2.23.0
- constraint: >=2.23.0
- per_payment_cap_usd: 1
- per_payment_cap_scope: per payment
- default_recognized_stablecoins_only: true
- spend_controls_opt_out: spendControls: false
- formal_advisory_published: false
- advisory_url: null
- reported_at: 2026-08-12
- fixed_at: 2026-08-20
- origin_header_rejected_since: null
- fixes: null
- source: https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html
- related_urls: https://v12.sh/blog/x402
- verified_at: 2026-10-24
- notes: V12 (2026-10-22) reports 25 vulnerabilities, including three critical findings reported 2026-08-12 and fixed by 2026-08-20. The Hacker News (2026-10-23) says the fixes are in this package at 2.23.0 or later, that patched clients cap each payment at $1 and accept only recognized stablecoins by default, and that spendControls: false disables that cap. The same article says no formal security advisory was published. This row does not state a minimum for other @x402 packages.

## @x402/axios

- id: x402-axios
- ecosystem: npm
- minimum_safe_version: 2.23.0
- constraint: >=2.23.0
- per_payment_cap_usd: 1
- per_payment_cap_scope: per payment
- default_recognized_stablecoins_only: true
- spend_controls_opt_out: spendControls: false
- formal_advisory_published: false
- advisory_url: null
- reported_at: 2026-08-12
- fixed_at: 2026-08-20
- origin_header_rejected_since: null
- fixes: null
- source: https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html
- related_urls: https://v12.sh/blog/x402
- verified_at: 2026-10-24
- notes: V12 (2026-10-22) reports 25 vulnerabilities, including three critical findings reported 2026-08-12 and fixed by 2026-08-20. The Hacker News (2026-10-23) says the fixes are in this package at 2.23.0 or later, that patched clients cap each payment at $1 and accept only recognized stablecoins by default, and that spendControls: false disables that cap. The same article says no formal security advisory was published. This row does not state a minimum for other @x402 packages.

## @x402/extensions

- id: x402-extensions
- ecosystem: npm
- minimum_safe_version: 2.23.0
- constraint: >=2.23.0
- per_payment_cap_usd: 1
- per_payment_cap_scope: per payment
- default_recognized_stablecoins_only: true
- spend_controls_opt_out: spendControls: false
- formal_advisory_published: false
- advisory_url: null
- reported_at: 2026-08-12
- fixed_at: 2026-08-20
- origin_header_rejected_since: null
- fixes: null
- source: https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html
- related_urls: https://v12.sh/blog/x402
- verified_at: 2026-10-24
- notes: V12 (2026-10-22) reports 25 vulnerabilities, including three critical findings reported 2026-08-12 and fixed by 2026-08-20. The Hacker News (2026-10-23) says the fixes are in this package at 2.23.0 or later, that patched clients cap each payment at $1 and accept only recognized stablecoins by default, and that spendControls: false disables that cap. The same article says no formal security advisory was published. This row does not state a minimum for other @x402 packages.

## @x402/svm

- id: x402-svm
- ecosystem: npm
- minimum_safe_version: 2.23.0
- constraint: >=2.23.0
- per_payment_cap_usd: 1
- per_payment_cap_scope: per payment
- default_recognized_stablecoins_only: true
- spend_controls_opt_out: spendControls: false
- formal_advisory_published: false
- advisory_url: null
- reported_at: 2026-08-12
- fixed_at: 2026-08-20
- origin_header_rejected_since: null
- fixes: null
- source: https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html
- related_urls: https://v12.sh/blog/x402
- verified_at: 2026-10-24
- notes: V12 (2026-10-22) reports 25 vulnerabilities, including three critical findings reported 2026-08-12 and fixed by 2026-08-20. The Hacker News (2026-10-23) says the fixes are in this package at 2.23.0 or later, that patched clients cap each payment at $1 and accept only recognized stablecoins by default, and that spendControls: false disables that cap. The same article says no formal security advisory was published. This row does not state a minimum for other @x402 packages.

## eclair

- id: eclair
- ecosystem: github
- minimum_safe_version: 0.14.5
- constraint: >=0.14.5
- per_payment_cap_usd: null
- per_payment_cap_scope: null
- default_recognized_stablecoins_only: null
- spend_controls_opt_out: null
- formal_advisory_published: null
- advisory_url: https://github.com/ACINQ/eclair/releases/tag/v0.14.5
- reported_at: null
- fixed_at: 2026-10-20
- origin_header_rejected_since: 0.14.4
- fixes: Optech #428 says 0.14.5 fixes trampoline-routing and taproot-splicing fund-theft vulnerabilities and an onion payload length overflow. The GitHub release says the patch contains security hardening fixes that malicious nodes could exploit.
- source: https://github.com/ACINQ/eclair/releases/tag/v0.14.5
- related_urls: https://bitcoinops.org/en/newsletters/2026/10/23/, https://github.com/ACINQ/eclair/blob/master/docs/release-notes/eclair-v0.14.5.md, https://github.com/ACINQ/eclair/releases/tag/v0.14.4
- verified_at: 2026-10-24
- notes: The GitHub release published 2026-10-20 says upgrading is strongly recommended and that the release is compatible without closing channels. Optech #428 says 0.14.4 rejects API requests that carry an Origin header, so browser integrations must call Eclair from their own backend. No CVE or formal advisory id is stated on those pages. formal_advisory_published is null because those pages do not say whether a separate advisory exists.

## BTCPay Server

- id: btcpay-server
- ecosystem: github
- minimum_safe_version: null
- constraint: null
- per_payment_cap_usd: null
- per_payment_cap_scope: null
- default_recognized_stablecoins_only: null
- spend_controls_opt_out: null
- formal_advisory_published: null
- advisory_url: https://bitcoinops.org/en/newsletters/2026/10/23/
- reported_at: null
- fixed_at: null
- origin_header_rejected_since: null
- fixes: Duplicate Lightning payouts and Greenfield API key scope escalation.
- source: https://bitcoinops.org/en/newsletters/2026/10/23/
- related_urls: null
- verified_at: 2026-10-24
- notes: Bitcoin Optech Newsletter #428 reports BTCPay Server fixes for duplicate Lightning payouts and Greenfield API key scope escalation. That newsletter does not name a release version. minimum_safe_version and constraint are null. The version is unverified.