bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list
What to do
- Upgrade to a fixed version: bitcoinjs-lib 5.2.1, bitcoinjs-lib 6.1.8, bitcoinjs-lib 7.0.2.
- Redeploy and restart long-running processes so they load the fixed code.
Affected packages
bitcoinjs-lib
- >= 2.3.0, < 5.2.1
- 5.2.1
Check your project: npm ls bitcoinjs-lib --all
Is bitcoinjs-lib@5.2.1 safe to install? See the upgrade verdict →
bitcoinjs-lib
- >= 6.0.0, < 6.1.8
- 6.1.8
Check your project: npm ls bitcoinjs-lib --all
Is bitcoinjs-lib@6.1.8 safe to install? See the upgrade verdict →
bitcoinjs-lib
- >= 7.0.0-rc.0, < 7.0.2
- 7.0.2
Check your project: npm ls bitcoinjs-lib --all
Is bitcoinjs-lib@7.0.2 safe to install? See the upgrade verdict →
What changed
Published in the GitHub Advisory Database as critical.