CVE-2026-107846: bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list
bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes. The affected block-root verifier was introduced as Block.checkMerkleRoot() alongside Block.calculateMerkleRoot(), while later versions expose validation through checkTxRoots() and checkMerkleRoot; these validation paths can accept a recomputed root without checking for mutation. A peer can append duplicate transactions so a different transaction list retains the original Merkle root, block header, proof of work, and block identifier. Consumers that rely on block-root validation, including explorers, exchange indexers, or SPV clients, can process a duplicated transaction twice or blacklist the shared block hash and reject the honest block. This issue is fixed in versions 5.2.1, 6.1.8, and 7.0.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitcoinjs-libto a version that resolves this vulnerability.Fixed in 5.2.1 - Upgrade
Upgrade
bitcoinjs-libto a version that resolves this vulnerability.Fixed in 6.1.8 - Upgrade
Upgrade
bitcoinjs-libto a version that resolves this vulnerability.Fixed in 7.0.2
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications that use bitcoinjs-lib to validate block transaction roots are exposed, including block explorers, exchange indexers, and SPV clients. The impact arises when those applications treat successful block-root validation as proof that the transaction list has not been mutated.
What does an attacker need to exploit the flaw?
An attacker can append duplicate transactions to a block transaction list. The resulting list can retain the original Merkle root, block header, proof of work, and block identifier, allowing it to pass the affected validation paths.
How can this affect transaction processing?
A vulnerable consumer may process a duplicated transaction twice. It may also blacklist the shared block hash after seeing the altered transaction list, causing it to reject the corresponding honest block.
Which versions should be used to remediate the issue?
Upgrade to bitcoinjs-lib version 5.2.1, 6.1.8, or 7.0.2, depending on the supported release line. These versions fix the missing detection of adjacent duplicate hashes during Merkle-root validation.