bitcoinjs-lib: forged transaction lists pass checkTxRoots via merkle node duplication (CVE-2026-107846)
Severity: critical · Patch status: patched · Since 2026-11-10 · CVE-2012-2459, CVE-2026-107846
bitcoinjs-lib's fastMerkleRoot pads an odd merkle level by hashing the last node with itself without flagging the duplication, and checkTxRoots never checks for repeated txids. A peer can duplicate transactions to fill the pad, producing a block with a different transaction list but the same merkle root, block hash and valid proof of work; checkTxRoots accepts the forged block. A public PoC mutates a real mainnet block from 9 to 10 and 12 transactions with an unchanged block id. This is the classic CVE-2012-2459 merkle-mutation flaw, which Bitcoin Core rejects via its mutated flag and bad-txns-duplicate check. All users of bitcoinjs-lib versions 2.3.0+ (except patched releases) doing block validation are affected. Fixed in 5.2.1, 6.1.8 and 7.0.2.
What to do
- Upgrade bitcoinjs-lib to 5.2.1, 6.1.8 or 7.0.2 depending on your major version
- Audit any code using fastMerkleRoot or checkTxRoots for block validation and add duplicate-txid/adjacent-equal-hash checks if upgrading is delayed
- Treat blocks accepted by vulnerable versions as unvalidated; re-verify merkle roots independently
- Monitor dependents of bitcoinjs-lib for patched releases
Fixed versions
- bitcoinjs-lib 5.2.1
- bitcoinjs-lib 6.1.8
- bitcoinjs-lib 7.0.2
Sources
All live incidents on Threat Watch
