1vulnerability
- Critical1 (100.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
bitcoinjs-lib
Ecosystem: npm
Downloads:
- 1CriticalAffects 3 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting bitcoinjs-lib, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-8vv3-6qpc-gpw6 | Critical | bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list### Summary `fastMerkleRoot` pads an odd level by hashing the last node with itself. It does not report that it did so, and `checkTxRoots` never looks for repeated transactions. A peer can therefore duplicate transactions to fill the pad and produce a block with a different transaction list but the same merkle root. The block hash and block id do not change, so the header still carries valid proof of work. In the proof of concept a real mainnet block goes from nine transactions to ten, and separately to twelve, with the same id every time, and `checkTxRoots` accepts all three. Bitcoin Core rej |
| GitHub (opens in a new tab) |
- GHSA-8vv3-6qpc-gpw6Criticalbitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list
>= 2.3.0, < 5.2.1>= 6.0.0, < 6.1.8- +1 more
Affected versions:>= 2.3.0, < 5.2.1>= 6.0.0, < 6.1.8>= 7.0.0-rc.0, < 7.0.2
### Summary `fastMerkleRoot` pads an odd level by hashing the last node with itself. It does not report that it did so, and `checkTxRoots` never looks for repeated transactions. A peer can therefore duplicate transactions to fill the pad and produce a block with a different transaction list but the same merkle root. The block hash and block id do not change, so the header still carries valid proof of work. In the proof of concept a real mainnet block goes from nine transactions to ten, and separately to twelve, with the same id every time, and `checkTxRoots` accepts all three. Bitcoin Core rej
CVE: CVE-2026-107846