JavaScript Library Vulnerability in bitcoinjs-lib Affects Node.js and Browser Users
CVE-2026-107846
What is CVE-2026-107846?
The bitcoinjs-lib is a JavaScript library utilized for Bitcoin transactions in Node.js and web environments. It contains a flaw in its handling of duplicate Merkle-tree nodes. The issue arises when fastMerkleRoot processes odd levels of the Merkle tree, padding by hashing the final node with itself without detecting repeated hashes. This vulnerability allows malicious peers to inject duplicate transactions into the system, which could lead to erroneous processing of the transaction list while keeping the original Merkle root intact. Consequently, reliant applications like explorers, exchange indexers, and SPV clients may either accept the duplicated transaction or mistakenly reject an honest block due to shared block hashes. This vulnerability was addressed in versions 5.2.1, 6.1.8, and 7.0.2, reinforcing block-root verification methods.
Affected Version(s)
bitcoinjs-lib >= 2.3.0, < 5.2.1 < 2.3.0, 5.2.1
bitcoinjs-lib >= 6.0.0, < 6.1.8 < 6.0.0, 6.1.8
bitcoinjs-lib >= 7.0.0-rc.0, < 7.0.2 < 7.0.0-rc.0, 7.0.2