bitcoinjs
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| tiny-secp256k1 | 2 | – | Jul 1, 2025 |
| bitcoinjs-lib | 1 | – | Nov 4, 2026 |
Exploited and recent CVEs
- CVE-2026-107846 bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list 0.2%
- CVE-2024-49364 tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment 0.4%
- CVE-2024-49365 tiny-secp256k1 allows for verify() bypass when running in bundled environment 0.2%