Left limbo: reviewed by GitHub after 15 days
GHSA-8vv3-6qpc-gpw6
bitcoinjs-lib on npm · published in bitcoinjs/bitcoinjs-lib
Facts
- Severity
- High
- Affected versions (bitcoinjs-lib)
- >= 2.3.0, < 5.2.1As entered by the maintainer. Not reviewed.
- Fixed in (bitcoinjs-lib)
- 5.2.1
- Affected versions (bitcoinjs-lib)
- >= 6.0.0, < 6.1.8As entered by the maintainer. Not reviewed.
- Fixed in (bitcoinjs-lib)
- 6.1.8
- Affected versions (bitcoinjs-lib)
- = 6.1.0-rc.0As entered by the maintainer. Not reviewed.
- Fixed in (bitcoinjs-lib)
- 6.1.8
- Affected versions (bitcoinjs-lib)
- >= 7.0.0-rc.0, < 7.0.2As entered by the maintainer. Not reviewed.
- Fixed in (bitcoinjs-lib)
- 7.0.2
- CVE
- CVE-2026-107846 · published
- GitHub Advisory Database
- Reviewed
- OSV.dev
- Not checked
- Other CVEs pointing here
- None found in the CVE List
If you use bitcoinjs-lib >= 2.3.0, < 5.2.1
Upgrade to 5.2.1 or later. It’s in GitHub’s reviewed database now, so Dependabot, npm audit and OSV-Scanner can report it.
Timeline
2026-10-26 18:39 UTC
Published by the maintainers
Cites CVE-2026-107846
2026-11-05 14:47 UTC
First seen by Limbowatch
In limbo
2026-11-11 09:38 UTC
Reviewed by GitHub
Left limbo after 15 days