-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0334
============================================================

Advisory-ID:  0xCERT-2026-0334
Severity:     Critical
Published:    2026-11-10T15:57:25.000Z
Updated:      2026-11-10T16:08:03.084Z
Chains:       Bitcoin
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0334

Title: bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list

Summary
- -------
bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list. fastMerkleRoot pads an odd level by hashing the last node with itself. It does not report that it did so, and checkTxRoots never looks for repeated transactions.

Details
- -------
Summary
fastMerkleRoot pads an odd level by hashing the last node with itself. It does not report that it did so, and checkTxRoots never looks for repeated transactions.

Affected
- - bitcoinjs-lib (npm) >= 2.3.0, < 5.2.1 — fixed in 5.2.1
- - bitcoinjs-lib (npm) >= 6.0.0, < 6.1.8 — fixed in 6.1.8
- - bitcoinjs-lib (npm) >= 7.0.0-rc.0, < 7.0.2 — fixed in 7.0.2

Severity
Critical (CVSS 9.3), as rated by the upstream advisory.

Recommended actions
- - Upgrade bitcoinjs-lib to 5.2.1 or later
- - Upgrade bitcoinjs-lib to 6.1.8 or later
- - Upgrade bitcoinjs-lib to 7.0.2 or later

Source & attribution
This 0xCERT advisory summarises GHSA-8vv3-6qpc-gpw6 / CVE-2026-107846 from the GitHub Advisory Database, credited upstream to 0xaudron, Ali-Kalout, landabaso, Kvazar-ai: https://github.com/advisories/GHSA-8vv3-6qpc-gpw6. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://github.com/advisories/GHSA-8vv3-6qpc-gpw6
- - CVE-2026-107846
- - https://github.com/bitcoinjs/bitcoinjs-lib/security/advisories/GHSA-8vv3-6qpc-gpw6
- - https://nvd.nist.gov/vuln/detail/CVE-2026-107846
- - https://github.com/bitcoinjs/bitcoinjs-lib/commit/009f165edfbf925cad8964b2dce478d18dd19449
- - https://github.com/bitcoinjs/bitcoinjs-lib/commit/b79c7714c0687473dc6e25c69fc5fc597302c7a0
- - https://github.com/bitcoinjs/bitcoinjs-lib/commit/f3434d1e4bb5e0784fe769c4cd08a243576232a1

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrzmIUJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmdoG0kjXyZaRYHMbuPahEqzbR35tBpNybqGvJCp
P30xARYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAABU0wEAxX7+NV+UmnWwWnAE
hTm44Bv09vAlKkeNDGWK7psf8IcA/2J0WlrvkZwTnvdlAbes+ZNR5veMctVH
VTM4rHiaAH4A
=tHVl
-----END PGP SIGNATURE-----