x402 payment SDK vulnerabilities: missing security advisory records

The Cloud Security Alliance (CSA) published a research note on October 26, 2026, following up on 25 vulnerabilities in the x402 Agent payment SDK disclosed by security firm V12, finding that fixes were rapid but the public security record was almost blank. Three critical vulnerabilities were merged and fixed within six days of the report, but the only two security advisories in the repository were unrelated to these findings, and @x402/fetch and @x402/extensions have no entries in the GitHub Advisory Database, so Dependabot and npm audit will not raise alerts; the spending cap fix was merged under the guise of a feature change, and another SIWx server-side authorization bypass has only CVE-2026-113603 assigned by third-party numbering authority VulnCheck, with the fix PR still unmerged as of October 26. CSA recommends directly comparing version upgrades, searching for spendControls: false, and replacing generic caps with price expectations independent of Agent reasoning.