CVE-2026-107846 | Bitcoinjs-Lib up to 5.2.0/6.1.7/7.0.1 Merkle Root Verification Block.checkMerkleRoot input validation

November 4, 2026 Yanac

A vulnerability labeled as critical has been found in Bitcoinjs-Lib up to 5.2.0/6.1.7/7.0.1. Affected by this issue is the function Block.checkMerkleRoot of the component Merkle Root Verification. Such manipulation leads to improper input validation.

This vulnerability is listed as CVE-2026-107846. The attack may be performed from remote. There is no available exploit.

The affected component should be upgraded.VulDB Recent EntriesRead More