29CVE-2026-107846bitcoinjs bitcoinjs-lib · bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction listIgnore reportBlock vendor9.30.2%