Bitcoinjs vulnerabilities
We track 3 vulnerabilities in Bitcoinjs products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on November 4, 2026.
Latest Bitcoinjs vulnerabilities
- 9.3 Critical severity
bitcoinjs-lib: Improper Validation of Integrity Check Value
bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes. The affected block
- 8.1 High severity
tiny-secp256k1: Improper Verification of Cryptographic Signature
tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a malicious JSON-stringifyable message can be made passing on verify(), when global Buffer is the buffer package. This affects only environments where require('buffer') is the NPM bu
- 8.1 High severity
tiny-secp256k1: Insufficiently Protected Credentials
tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a private key can be extracted on signing a malicious JSON-stringifiable object, when global Buffer is the buffer package. This affects only environments where require('buffer') is t