Kritisch 9.3Software
CVE-2026-107846
bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list
bitcoinjs-lib, bitcoinjs-lib, bitcoinjs-lib
bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes. The affected block-root verifier was introduced as Block.checkMerkleRoot() alongside Block.calculateMerkleRoot(), while later versions expose validation through checkTxRoots() and __checkMerkleRoot; these validation paths can accept a…
4. Nov 2026
Original bei NVD öffnen