ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-107846

bitcoinjs-lib · Vulnerability

CVSS 4.0 9.3 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 9 Nov 2026 18:02:10 UTC. Read the latest advisory.

cve-program · CVE-2026-107846

Published

bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes. The affected block-root verifier was introduced as Block.checkMerkleRoot() alongside Block.calculateMerkleRoot(), while later versions expose validation through checkTxRoots() and __checkMerkleRoot; these validation paths can accept a recomputed root without checking for mutation. A peer can append duplicate transactions so a different transaction list retains the original Merkle root, block header, proof of work, and block identifier. Consumers that rely on block-root validation, including explorers, exchange indexers, or SPV clients, can process a duplicated transaction twice or blacklist the shared block hash and reject the honest block. This issue is fixed in versions 5.2.1, 6.1.8, and 7.0.2.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-107846

Published

bitcoinjs-lib

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "bitcoinjs",
                    "product": "bitcoinjs-lib",
                    "versions": [
                        {
                            "version": ">= 2.3.0, < 5.2.1",
                            "status": "affected"
                        },
                        {
                            "version": ">= 6.0.0, < 6.1.8",
                            "status": "affected"
                        },
                        {
                            "version": ">= 7.0.0-rc.0, < 7.0.2",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON