npm: bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list

npm: bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list vulnerability discovered by ? in WordPress npm bitcoinjs-lib versions = 2.3.0, 5.2.1...

bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list

Summary fastMerkleRoot pads an odd level by hashing the last node with itself. It does not report that it did so, and checkTxRoots never looks for repeated transactions. A peer can therefore duplicate transactions to fill the pad and produce a block with a different transaction list but the same...

CVE-2026-107846 bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list

bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes. The affected block-root verifier was introduced as...