Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes. The affected block-root verifier was introduced as Block.checkMerkleRoot() alongside Block.calculateMerkleRoot(), while later versions expose validation through checkTxRoots() and __checkMerkleRoot; these validation paths can accept a recomputed root without checking for mutation. A peer can append duplicate transactions so a different transaction list retains the original Merkle root, block header, proof of work, and block identifier. Consumers that rely on block-root validation, including explorers, exchange indexers, or SPV clients, can process a duplicated transaction twice or blacklist the shared block hash and reject the honest block. This issue is fixed in versions 5.2.1, 6.1.8, and 7.0.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
🆕 New CVE bitcoinjs-lib: forged block transactions accepted via merkle duplication (CVE-2026-107846) A remote attacker can append duplicate transactions to a block while keeping its original root and ID. Patch → 5.2.1, 6.1.8 and more https://cve.now/CVE-2026-107846?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical
bitcoinjs-lib CVE-2026-107846 (CVSS 9.3): fastMerkleRoot pads odd tree levels without reporting it, and checkTxRoots never checks for adjacent duplicate hashes. A forged block with a different transaction list can pass validation. Fixed in 5.2.1, 6.1.8 and 7.0.2. No workaround is listed. VulnTracker recommends upgrading and checking lockfiles for copies of the library. Details: http://vulntracker.io/cves/CVE-2026-107846 #bitcoinjs #Bitcoin #InfoSec
🔴 bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list (CVE-2026-107846) Fix → 5.2.1, 6.1.8 +1 https://agentprime.io/advisories/CVE-2026-107846/