A peer can supply a block with duplicated transactions while preserving the original Merkle root and block identifier. The affected validator can accept both the original and altered transaction lists. The advisory limits the impact to consumers that rely on bitcoinjs-lib block-root validation.
What it allows
- Product.
- bitcoinjs-lib.
- CVSS.
- 9.3 Critical, CVSS 4.0.
- Fixed.
- 5.2.1, 6.1.8, and 7.0.2.
- CISA KEV.
- Not listed on November 9, 2026.
How Does CVE-2026-107846 Affect Merkle Validation?
A Bitcoin Merkle tree duplicates its final node when a level contains an odd number of nodes. The library's fastMerkleRoot function performs this padding but does not report adjacent duplicate hashes.
The validator then compares the recalculated root with the block header. It does not separately reject the duplicated transaction pair described by the advisory.
- Odd Merkle levelThe final node is duplicated for padding
- Altered transaction listA peer supplies duplicate transactions
- Root recalculationThe different list retains the original Merkle root
- Integrity checkThe affected validator accepts the matching root
The header, proof of work, and block identifier remain unchanged in the documented condition. No new mining is required because the altered transaction list does not change the header.
An explorer, exchange indexer, or SPV client may process a duplicated transaction twice when it trusts this check. A consumer may also blacklist the shared block hash and reject the honest block.
Who is affected
Which bitcoinjs-lib Versions Are Affected by CVE-2026-107846?
The advisory lists versions 2.3.0 through 5.2.0 and versions 6.0.0 through 6.1.7. It also covers 7.0.0-rc.0 through 7.0.1.
Patched releases are 5.2.1, 6.1.8, and 7.0.2 for their respective maintained lines. Versions below 5 have no in-line patch and must move to a fixed line.
Exposure depends on whether a consumer uses the affected block-root validation path. The advisory identifies explorers, exchange indexers, and SPV clients as examples, not confirmed affected deployments.
Timeline
- 2026-10-26
The GitHub security advisory was first published.
- 2026-11-04
NVD published the CVE-2026-107846 record.
- 2026-11-10
GitHub reviewed and updated the advisory.
What to do
-
Upgrade to a patched bitcoinjs-lib release
Move each supported dependency line to 5.2.1, 6.1.8, or 7.0.2 and later. Applications below version 5 must upgrade to a fixed line.
-
Find consumers that validate complete blocks
Inventory services using bitcoinjs-lib to parse or validate block transaction roots. Prioritize explorers, indexers, and SPV clients that make state decisions from this result.
-
Test rejection of duplicate transaction trees
In an isolated test environment, confirm the updated application rejects adjacent duplicate hashes before odd-node padding. Avoid using public networks or production transaction data.
-
Review downstream credit and block handling
Check whether transaction credits or block blacklisting depend solely on the affected validation result. Require independent transaction uniqueness and consensus checks where appropriate.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-107846?
It is a bitcoinjs-lib Merkle-root validation flaw. The affected check can accept a duplicated transaction list that retains the original root and block identifier.
Which bitcoinjs-lib versions are affected by CVE-2026-107846?
Affected versions are 2.3.0 through 5.2.0, 6.0.0 through 6.1.7, and 7.0.0-rc.0 through 7.0.1.
Which bitcoinjs-lib versions fix CVE-2026-107846?
The fixed releases are 5.2.1, 6.1.8, and 7.0.2. Users on versions below 5 must upgrade to a fixed release line.
Is CVE-2026-107846 being exploited?
Exploitation status is unknown. CISA's November 9, 2026 KEV snapshot does not list it, while Brandefense Blackhole recorded one Telegram post during the 90-day review window.
What systems should teams prioritize for CVE-2026-107846?
Prioritize services that use bitcoinjs-lib block-root validation for transaction processing or block decisions. The advisory names explorers, exchange indexers, and SPV clients as examples.
Sources
- bitcoinjs-lib Undetected Merkle Node Duplication AdvisoryGitHub Advisory Database
- CVE-2026-107846 DetailNational Vulnerability Database
- Known Exploited Vulnerabilities CatalogCybersecurity and Infrastructure Security Agency
