EUVD-2026-117051

bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list...

GHSA-8VV3-6QPC-GPW6 bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list

Summary fastMerkleRoot pads an odd level by hashing the last node with itself. It does not report that it did so, and checkTxRoots never looks for repeated transactions. A peer can therefore duplicate transactions to fill the pad and produce a block with a different transaction list but the same...

bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list

Summary fastMerkleRoot pads an odd level by hashing the last node with itself. It does not report that it did so, and checkTxRoots never looks for repeated transactions. A peer can therefore duplicate transactions to fill the pad and produce a block with a different transaction list but the same...

CVE-2026-107846

bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes. The affected block-root verifier was introduced as...

CVE-2026-107846

The bitcoinjs-lib JavaScript library (versions 2.3.0 until 5.2.1, 6.1.8, and 7.0.2) contains a vulnerability in the fastMerkleRoot function. The root cause is that the function pads odd Merkle-tree levels by hashing the final node with itself without reporting adjacent duplicate hashes. This allo...

BitcoinJS-Lib encryption issue vulnerability

Versions 2.3.0 through 5.2.1, 6.0.0 through 6.1.8, and 7.0.0-rc.0 through 7.0.2 of bitcoinjs-lib contain an encryption vulnerability. This vulnerability arises because fastMerkleRoot fails to report adjacent duplicate hashes when filling odd layers of the Merkle tree; additionally, block root...