Skip to content
Latest alertbitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list
0xCERT
Report incident
All advisories
Critical0xCERT-2026-0334·

bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list

bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list. fastMerkleRoot pads an odd level by hashing the last node with itself. It does not report that it did so, and checkTxRoots never looks for repeated transactions.

Vuln-watch · relayed from the GitHub Advisory Database; see Source & attribution below

Affected chainsBitcoin

Summary

fastMerkleRoot pads an odd level by hashing the last node with itself. It does not report that it did so, and checkTxRoots never looks for repeated transactions.

Affected

  • bitcoinjs-lib (npm) >= 2.3.0, < 5.2.1 — fixed in 5.2.1
  • bitcoinjs-lib (npm) >= 6.0.0, < 6.1.8 — fixed in 6.1.8
  • bitcoinjs-lib (npm) >= 7.0.0-rc.0, < 7.0.2 — fixed in 7.0.2

Severity

Critical (CVSS 9.3), as rated by the upstream advisory.

Recommended actions

  • Upgrade bitcoinjs-lib to 5.2.1 or later
  • Upgrade bitcoinjs-lib to 6.1.8 or later
  • Upgrade bitcoinjs-lib to 7.0.2 or later

Source & attribution

This 0xCERT advisory summarises GHSA-8vv3-6qpc-gpw6 / CVE-2026-107846 from the GitHub Advisory Database, credited upstream to 0xaudron, Ali-Kalout, landabaso, Kvazar-ai: https://github.com/advisories/GHSA-8vv3-6qpc-gpw6. Details may change; refer to the original source for the authoritative record.

References

OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.

Published 2026-11-10 · last updated 2026-11-10

curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0334/signed.txt | gpg --verify