Threats affecting pkg:npm/bitcoinjs-lib

bitcoinjs-lib versions from 2.3.0 up to but not including 5.2.1, 6.0.0 up to 6.1.8, and 7.0.0-rc.0 up to 7.0.2 contain a vulnerability in Merkle root validation. The library's fastMerkleRoot function pads odd Merkle-tree levels by hashing the final node with itself but does not detect adjacent duplicate hashes, allowing a peer to append duplicate transactions without changing the Merkle root or block identifiers. This can cause consumers relying on block-root validation, such as explorers or SPV clients, to process duplicated transactions or reject valid blocks. The issue is fixed in versions 5.2.1, 6.1.8, and 7.0.2.