PT-2026-125876
CVE-2026-107847
·
Published
2026-10-27
·
Updated
2026-10-27
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
🚨 MAJOR SECURITY ALERT: bitcoinjs patches multiple high security issues in their packages
We hit some of the most critical infrastructure in Bitcoin is dependent on bitcoinjs packages—bitcoinjs-lib, bip39, tiny-secp256k1 were affected are ato multiple high security issues affecting major wallets, protocols, bitcoin infra and sdks :
bitcoinjs-lib: CVE-2026-107846, GHSA-8247-5gp7-95qh, GHSA-4mfv-5394-26c7, GHSA-88jr-9qj4-ccm4, GHSA-h52v-8xwg-7j95 (patch versions: 7.0.5, 6.1.10, 5.2.3)
bip39: CVE-2026-107847, GHSA-39w3-8jr6-f676 (latest patch version: 3.1.12)
tiny-secp256k1: CVE-2026-107853, GHSA-85g9-f6v5-wqq7, GHSA-rm9w-7fv8-3rhx (latest patch version: 2.2.5)
All of the above packages have ~500k downloads/week.
Also, multiple other CVEs/disclosures took place over more libs of bitcoinjs by other researchers like the ARSB and Bitcoin Red Team:
bitcoinjs-lib: GHSA-4vm8-79jj-j6w4 (patch versions: v7.0.5, 6.1.10, 5.2.3)
bip38: GHSA-mj7w-64jg-8f98
bip32-utils: GHSA-wvw7-chj5-hr2g(patch version: 0.11.2)
merkle-lib: GHSA-g353-54jg-j6gg (patch version: 2.0.11)
bolt11: CVE-2026-107855 (patch version: 1.4.2)
There are a total of 15 findings (14 highs, 1 medium) and cover areas including transaction and block parsing, PSBT fee calculations, proof verification, mnemonic handling and elliptic-curve operations. Their impact depends on the affected version and how an application uses the library. Each advisory explains those conditions and the required remediation.
It was greating coordinating with @junderwood4649, @landabaso.
Found an issue in the description? Have something to add? Feel free to write us 👾