CVE-2026-107846
bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list
Using bitcoinjs-lib by bitcoinjs?
Get instant alerts when new vulnerabilities affect bitcoinjs-lib - before attackers find them.
Description
bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes. The affected block-root verifier was introduced as Block.checkMerkleRoot() alongside Block.calculateMerkleRoot(), while later versions expose validation through checkTxRoots() and __checkMerkleRoot; these validation paths can accept a recomputed root without checking for mutation. A peer can append duplicate transactions so a different transaction list retains the original Merkle root, block header, proof of work, and block identifier. Consumers that rely on block-root validation, including explorers, exchange indexers, or SPV clients, can process a duplicated transaction twice or blacklist the shared block hash and reject the honest block. This issue is fixed in versions 5.2.1, 6.1.8, and 7.0.2.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Remediation
VTDB RemediationNo fix recorded
VTDB RemediationAI-generated · claude-opus-5-5 · published by VulnTracker
Upgrade bitcoinjs-lib to 5.2.1, 6.1.8 or 7.0.2 (by major line) in every application that validates block Merkle roots with it, because earlier versions from 2.3.0 on accept mutated blocks with duplicated transactions.
- 1
Find every use of bitcoinjs-lib, including transitive ones
Search lockfiles and dependency trees (for example with npm ls bitcoinjs-lib) for bitcoinjs-lib versions from 2.3.0 up to (not including) 5.2.1, 6.0.0 up to 6.1.8, and 7.0.0-rc.0 up to 7.0.2. Versions older than 2.3.0 are not affected. Prioritise explorers, exchange indexers, SPV clients and any other code that relies on Block.checkMerkleRoot(), checkTxRoots() or __checkMerkleRoot to validate blocks.
Fact: affected ranges for bitcoinjs-bitcoinjs-lib and the CVE description
- 2
Upgrade to the fixed release for your major line
Move 6.x to 6.1.8 or later and 7.x (including 7.0.0 release candidates) to 7.0.2 or later. Applications on 2.3.0 through 5.2.0 must move to 5.2.1 or later, which for 2.x, 3.x and 4.x users is a major-version upgrade, so plan for API changes. Our records list these versions as the first outside the affected ranges, and the CVE description also states the issue is fixed in 5.2.1, 6.1.8 and 7.0.2.
https://github.com/bitcoinjs/bitcoinjs-lib/security/advisories/GHSA-8vv3-6qpc-gpw6 - 3
Rebuild and redeploy with the updated lockfile
Regenerate lockfiles so no copy of an affected version remains, including copies pulled in by other dependencies or bundled into browser builds. Then rebuild and redeploy every service and front end that ships the library.
Fact: description notes the library is used in both Node.js and browsers
- 4
Review data processed by affected validators
The description says consumers relying on the flawed validation can process a duplicated transaction twice or blacklist an honest block hash. In indexers and similar systems that ran an affected version, check for transactions recorded more than once and for block hashes marked invalid or rejected, and correct any you find.
Fact: CVE description (duplicated transactions processed twice; shared block hash blacklisted)
The record has no fixes entries, so 5.2.1, 6.1.8 and 7.0.2 come from the affected-range bounds. The CVE description independently names them as fixed, but the facts do not record a separate vendor fix row. The references include three upstream commits, but the facts do not say which branch each fix landed on; use the release versions, not the commits, as upgrade targets. The references describe no workaround short of upgrading. No exploitation is recorded (is_exploited is false), and there is no KEV entry or vendor advisory record beyond the GitHub security advisory.
Guidance updated 2026-11-05
References (4)
CVSS
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.