Bitcoinjs-Lib up to 5.2.0/6.1.7/7.0.1 Merkle Root Verification Block.checkMerkleRoot input validation

Summaryinfo

A vulnerability marked as critical has been reported in Bitcoinjs-Lib up to 5.2.0/6.1.7/7.0.1. This affects the function Block.checkMerkleRoot of the component Merkle Root Verification. Performing a manipulation results in input validation. This vulnerability is cataloged as CVE-2026-107846. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Bitcoinjs-Lib up to 5.2.0/6.1.7/7.0.1. It has been classified as critical. This affects the function Block.checkMerkleRoot of the component Merkle Root Verification. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on integrity, and availability. The summary by CVE is:

bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes. The affected block-root verifier was introduced as Block.checkMerkleRoot() alongside Block.calculateMerkleRoot(), while later versions expose validation through checkTxRoots() and __checkMerkleRoot; these validation paths can accept a recomputed root without checking for mutation. A peer can append duplicate transactions so a different transaction list retains the original Merkle root, block header, proof of work, and block identifier. Consumers that rely on block-root validation, including explorers, exchange indexers, or SPV clients, can process a duplicated transaction twice or blacklist the shared block hash and reject the honest block. This issue is fixed in versions 5.2.1, 6.1.8, and 7.0.2.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-107846 since 10/09/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

Upgrading to version 5.2.1, 6.1.8 or 7.0.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Bitcoinjs-Lib

Version

• 5.0
• 5.1
• 5.2.0
• 6.1.0
• 6.1.1
• 6.1.2
• 6.1.3
• 6.1.4
• 6.1.5
• 6.1.6
• 6.1.7
• 7.0.0
• 7.0.1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion