bitcoinjs-lib vulnerabilities

CVEs whose affected-version data names the bitcoinjs-lib package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-107846Critical· 9.3

4d ago

bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list

bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate has…

▾ Midnightbitcoinjs · bitcoinjs-libEPSS 0.18%via CVEORG