L3 · ShartedBitcoin · JavaScript · PSBTbitcoinjs-security-batch

bitcoinjs-lib patches six fee-accounting, block-validation and parsing flaws

Six advisories cover understated miner fees, invalid block checks and parsing denial of service. Upgrade to 5.2.3 / 6.1.10 / 7.0.5 for the full batch. Loss requires downstream reliance and, for excess fees, a valid transaction broadcast and accepted by the network; real-world exploitation is unconfirmed.

Disclosed: Oct 26, 2026; Updated Oct 28, 2026
Severity: Sharted; 6 CVEs tracked here
Splash zone: Apps accepting untrusted PSBTs, transactions or blocks and relying on bitcoinjs-lib fee, parsing or validation APIs; Bitcoin · JavaScript · PSBT
In the wild: Unknown; Advisories demonstrate defects but do not establish real-world exploitation.

What happened

The fee defects affect applications trusting imported, updated or combined PSBT metadata. Excess value becomes a miner fee, not automatically a payment to the PSBT author, and the defects cannot manufacture signatures. Missing-amount handling also affects already finalized inputs.

The missing-value flaw begins in v5.1.0, conflicting-record handling in v5.2.0, Merkle validation in v2.3.0 and proof-of-work checking in v2.2.0; v6 and v7 release candidates are included where the advisories specify them. Both copying defects affect v7 through 7.0.2; untrusted parsing can stall the synchronous event loop before validation.

These library bugs do not establish a Bitcoin Core consensus compromise or a confirmed loss. L3 reflects public reproductions and downstream financial/availability risks. This is distinct from the Electrum malicious-server incident.

Update, October 28: Review verified that the Merkle-duplication advisory GHSA-8vv3-6qpc-gpw6 now lists CVE-2026-107846. These identify the same flaw; the batch still contains six vulnerabilities. The review date does not establish when the identifier was assigned.

What’s in the bowl

CVE-2026-107846

Undetected Merkle duplication

Forged transaction lists can pass block-root checks.

GHSA-88jr-9qj4-ccm4

Transaction parsing denial of service

Repeated integer reads copy whole buffers in affected v7 dependency trees.

GHSA-8247-5gp7-95qh

Block parsing denial of service

The v7 Uint8Array parser repeatedly copies remaining block data.

GHSA-4mfv-5394-26c7

Conflicting PSBT UTXO records

Signing and fee accounting can resolve inconsistent input values.

GHSA-h52v-8xwg-7j95

Missing finalized PSBT input values

Missing UTXO records can count as zero and understate fees.

GHSA-4vm8-79jj-j6w4

Invalid proof-of-work targets

Header checks can accept invalid compact targets; application impact depends on reliance.

Fixed versions

Product	Safe from	Note
bitcoinjs-lib 5	`5.2.3`	Covers all six advisories
bitcoinjs-lib 6	`6.1.10`	Covers all six advisories
bitcoinjs-lib 7	`7.0.5`	Covers all six advisories
Affected versions below 5	No fix	Upgrade to a patched line; no in-line backport

Crime-scene timeline

Oct 26, 2026
Six security advisories published
Different defects have different fix thresholds; use the complete-batch versions above.
Oct 28, 2026
Review verifies CVE-2026-107846 on the Merkle advisory

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

bitcoinjs-lib — Undetected Merkle duplicationPrimaryCVE-2026-107846, Merkle-duplication PoC and fixes 5.2.1 / 6.1.8 / 7.0.2.
bitcoinjs-lib — Transaction parsing denial of servicePrimaryv7 parser exposure and 7.0.3 fix; no valid mined block required.
bitcoinjs-lib — Block parsing denial of servicePrimaryv7 parser exposure and 7.0.3 fix; no valid mined block required.
bitcoinjs-lib — Conflicting PSBT UTXO recordsPrimaryPSBT prerequisites, no automatic coin theft, fixed in 5.2.2 / 6.1.9 / 7.0.4.
bitcoinjs-lib — Missing finalized PSBT input valuesPrimaryPSBT prerequisites, no automatic coin theft, fixed in 5.2.2 / 6.1.9 / 7.0.4.
bitcoinjs-lib — Invalid proof-of-work targetsPrimaryAdds the final batch thresholds 5.2.3 / 6.1.10 / 7.0.5; no backports below v5.

Wipe guide

The wipe checklist

0 of 4 sheets used

Update every resolved copy and rebuild consumersUse npm ls bitcoinjs-lib and the lockfile. The fee fixes alone are 5.2.2 / 6.1.9 / 7.0.4; those remain affected by the proof-of-work-target flaw. Use 5.2.3 / 6.1.10 / 7.0.5 for the whole batch.
Independently validate PSBT input amountsVerify prevouts for every input, reject disagreeing witnessUtxo/nonWitnessUtxo records, and require amounts even on finalized inputs. Check the actual miner fee before broadcast; do not disable maximumFeeRate as a workaround.
Treat block helpers as partial validationReject mutated Merkle trees and invalid compact targets; enforce the network proof-of-work limit and chain-specific difficulty separately. A true checkProofOfWork result is not complete consensus validation.
Bound and isolate untrusted parsingLimit input sizes and use separate parsing workers. On v7 verify nested uint8array-tools >=0.0.10, varuint-bitcoin >=2.0.1 and bip174 >=3.0.1; dependency updates alone do not fix the independent block-suffix copy.