Threats tagged 'ghsa-8vv3-6qpc-gpw6'

bitcoinjs-lib versions prior to 5.2.1, 6.1.8, and 7.0.2 contain a vulnerability (CVE-2026-107846) where the fastMerkleRoot function does not detect duplicated transactions used to pad odd levels in the Merkle tree. This allows a forged block with a different transaction list but the same Merkle root and block ID to be accepted by the library's checkTxRoots function. Bitcoin Core mitigates this by detecting such mutations and rejecting the block, but bitcoinjs-lib lacks this check.