Bitcoinjs

3 CVEs in 2 Bitcoinjs products, including Tiny-Secp256k1, Bitcoinjs-Lib. Newest: CVE-2026-107846 (2026-11-04). Severity, EPSS and public exploits for each.

Bitcoinjs products with known CVEs

ProductCVEs
Tiny-Secp256k12
Bitcoinjs-Lib1
Bitcoinjs CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-1078462026-11-04bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by…
CVE-2024-493652025-07-01tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a malicious JSON-stringifyable message can be made passing on verify(), when glob…
CVE-2024-493642025-07-01tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a private key can be extracted on signing a malicious JSON-stringifiable object…