CVE-2026-34210

@@ -6,7 +6,11 @@
  */
 export type StripeClient = {
   paymentIntents: {
-    create(...args: any[]): Promise<{ id: string; status: string }>
+    create(...args: any[]): Promise<{
+      id: string
+      status: string
+      lastResponse?: { headers?: Record<string, string> }
+    }>
   }
 }
 

@@ -16,9 +16,15 @@ function createMockStripeClient(
   overrides?: Partial<{ status: string; id: string; throws: boolean }>,
 ): { client: StripeClient; create: ReturnType<typeof vi.fn> } {
   const { status = 'succeeded', id = 'pi_mock_123', throws = false } = overrides ?? {}
+  let callCount = 0
   const create = vi.fn(async () => {
     if (throws) throw new Error('Stripe API error')
-    return { id, status }
+    callCount++
+    return {
+      id,
+      status,
+      ...(callCount > 1 ? { lastResponse: { headers: { 'idempotent-replayed': 'true' } } } : {}),
+    }
   })
   return {
     client: { paymentIntents: { create } },
@@ -196,6 +202,51 @@ describe('stripe.charge with client', () => {
     expect(body.detail).toContain('requires action')
   })
 
+  test('behavior: rejects replayed credential', async () => {
+    const { client } = createMockStripeClient()
+
+    const server = Mppx.create({
+      methods: [
+        stripe.charge({
+          client,
+          networkId: 'internal',
+          paymentMethodTypes: ['card'],
+        }),
+      ],
+      realm,
+      secretKey,
+    })
+
+    const handle = server.charge({ amount: '1', currency: 'usd', decimals: 2 })
+
+    // First request: get challenge
+    const firstResult = await handle(new Request('https://example.com'))
+    expect(firstResult.status).toBe(402)
+    if (firstResult.status !== 402) throw new Error()
+
+    const challenge = Challenge.fromResponse(firstResult.challenge)
+    const credential = Credential.from({
+      challenge,
+      payload: { spt: 'spt_test_token' },
+    })
+
+    // First payment: should succeed
+    const result1 = await handle(
+      new Request('https://example.com', {
+        headers: { Authorization: Credential.serialize(credential) },
+      }),
+    )
+    expect(result1.status).toBe(200)
+
+    // Replay same credential: should be rejected
+    const result2 = await handle(
+      new Request('https://example.com', {
+        headers: { Authorization: Credential.serialize(credential) },
+      }),
+    )
+    expect(result2.status).toBe(402)
+  })
+
   test('behavior: receipt contains mock reference', async () => {
     const { client } = createMockStripeClient({ id: 'pi_custom_ref' })
 

@@ -89,6 +89,9 @@ export function charge<const parameters extends charge.Parameters>(parameters: p
             metadata: resolvedMetadata,
           })
 
+      if (pi.replayed)
+        throw new VerificationFailedError({ reason: 'Payment has already been processed.' })
+
       if (pi.status === 'requires_action') {
         throw new PaymentActionRequiredError({ reason: 'Stripe PaymentIntent requires action' })
       }
@@ -136,7 +139,7 @@ async function createWithClient(parameters: {
   metadata: Record<string, string>
   request: { amount: unknown; currency: unknown }
   spt: string
-}): Promise<{ id: string; status: string }> {
+}): Promise<{ id: string; status: string; replayed: boolean }> {
   const { client, challenge, metadata, request, spt } = parameters
   try {
     const result = await client.paymentIntents.create(
@@ -151,7 +154,9 @@ async function createWithClient(parameters: {
       } as any,
       { idempotencyKey: `mppx_${challenge.id}_${spt}` },
     )
-    return { id: result.id, status: result.status }
+    // https://docs.stripe.com/error-low-level#idempotency
+    const replayed = result.lastResponse?.headers?.['idempotent-replayed'] === 'true'
+    return { id: result.id, status: result.status, replayed }
   } catch {
     throw new VerificationFailedError({ reason: 'Stripe PaymentIntent failed' })
   }
@@ -164,7 +169,7 @@ async function createWithSecretKey(parameters: {
   metadata: Record<string, string>
   request: { amount: unknown; currency: unknown }
   spt: string
-}): Promise<{ id: string; status: string }> {
+}): Promise<{ id: string; status: string; replayed: boolean }> {
   const { secretKey, challenge, metadata, request, spt } = parameters
 
   const body = new URLSearchParams({
@@ -190,7 +195,10 @@ async function createWithSecretKey(parameters: {
   })
 
   if (!response.ok) throw new VerificationFailedError({ reason: 'Stripe PaymentIntent failed' })
-  return (await response.json()) as { id: string; status: string }
+  // https://docs.stripe.com/error-low-level#idempotency
+  const replayed = response.headers.get('idempotent-replayed') === 'true'
+  const result = (await response.json()) as { id: string; status: string }
+  return { ...result, replayed }
 }
 
 /** @internal */