bitcoinjs-lib block root check accepts duplicated transaction lists
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
bitcoinjs-lib from 2.3.0 before 5.2.1, from 6.0.0 before 6.1.8, and from 7.0.0-rc.0 before 7.0.2 pads odd Merkle tree levels by hashing the last node with itself without reporting duplicate hashes. This is an improper validation of an integrity check value (CWE-354), so the block root check accepts a recomputed root without detecting mutation. A remote peer without privileges can append duplicate transactions that keep the original Merkle root and block header, so consumers such as explorers, exchange indexers, or SPV clients may process a transaction twice or reject the honest block.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes. The affected block-root verifier was introduced as Block.checkMerkleRoot() alongside Block.calculateMerkleRoot(), while later versions expose validation through checkTxRoots() and __checkMerkleRoot; these validation paths can accept a recomputed root without checking for mutation. A peer can append duplicate transactions so a different transaction list retains the original Merkle root, block header, proof of work, and block identifier. Consumers that rely on block-root validation, including explorers, exchange indexers, or SPV clients, can process a duplicated transaction twice or blacklist the shared block hash and reject the honest block. This issue is fixed in versions 5.2.1, 6.1.8, and 7.0.2.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| bitcoinjs | bitcoinjs-lib | 2.3.0 to before 5.2.1; 6.0.0 to before 6.1.8; 7.0.0-rc.0 to before 7.0.2 | 5.2.1, 6.1.8, 7.0.2 | Patch available | CNA |
- bitcoinjs-lib Vendorbitcoinjs Affected 2.3.0 to before 5.2.1; 6.0.0 to before 6.1.8; 7.0.0-rc.0 to before 7.0.2 Fixed in 5.2.1, 6.1.8, 7.0.2 Patch available CNA
Remediation
Upgrade to bitcoinjs-lib 5.2.1, 6.1.8, or 7.0.2, depending on the release branch in use.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA bitcoinjs-lib (bitcoinjs) Fixed in 5.2.1, 6.1.8, 7.0.2
Timeline
- 2026-11-04 Threatist record created from CVE-2026-107846
- 2026-11-06 Priority changed: MEDIUM → LOW
References
Other 4
- https://github.com/bitcoinjs/bitcoinjs-lib/security/advisories/GHSA-8vv3-6qpc-gpw6
- https://github.com/bitcoinjs/bitcoinjs-lib/commit/009f165edfbf925cad8964b2dce478d18dd19449
- https://github.com/bitcoinjs/bitcoinjs-lib/commit/b79c7714c0687473dc6e25c69fc5fc597302c7a0
- https://github.com/bitcoinjs/bitcoinjs-lib/commit/f3434d1e4bb5e0784fe769c4cd08a243576232a1
More bitcoinjs vulnerabilities
- TI-2024-32953 tiny-secp256k1 allows for verify() bypass when running in bundled environment CVSS 4.0HIGH 8.1
- TI-2024-32952 Insufficiently protected credentials in bitcoinjs tiny-secp256k1 CVSS 4.0HIGH 8.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences