bitcoinjs-lib calculates the Merkle root of a block by padding odd levels of the Merkle tree. The implementation does not detect adjacent duplicate hashes, allowing a peer to append duplicate transactions. As a result, a forged transaction list can produce the same Merkle root, block header, proof‑of‑work, and block identifier as a legitimate block. The flaw enables a malicious actor to process a duplicated transaction twice, or to make an honest block appear invalid and be rejected. The vulnerability is a direct compromise of transaction and block integrity, classified under CWE‑354.

The affected library is bitcoinjs:bitcoinjs-lib. Versions from 2.3.0 up to and including 5.2.1, 6.1.8, and 7.0.2 contain the weakness. All builds of the library within these ranges used the same Merkle‑root calculation code.

The CVSS score of 9.3 indicates critical severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog at this time. A direct attacker would need to supply a manipulated block or transaction list to a client or indexer that relies on the library’s Merkle‑root validation. If the application blindly accepts the recomputed root without validating mutations, the exploit is feasible and could lead to double‑spending or block rejection attacks. While the exact likelihood of exploitation is uncertain due to missing EPSS data, the high CVSS score and the fundamental nature of the flaw warrant immediate attention.