EN
Español
Português (Brasil)
Türkçe
Tiếng Việt
Bahasa Indonesia
Polski
Čeština
Română
Slovenčina
Magyar28 Oct 2026
Bitcoinjs-lib, a widely used JavaScript library for building Bitcoin apps, has patched two bugs that can make software understate the miner fee on a valid partially signed transaction. In one demo the real fee was 9 BTC while the library reported 200 satoshi. Fixed versions are 5.2.2, 6.1.9 and 7.0.4.
Bitcoin TradeReviewed News Desk
Bitcoinjs-lib, a JavaScript library that many wallets and Bitcoin apps use to build transactions, has patched two bugs that can make software badly understate the miner fee on a valid transaction, CryptoSlate reported, citing security disclosures published on Oct. 26. The fixes ship in versions 5.2.2, 6.1.9 and 7.0.4.
What went wrong with PSBT fee checks
Both flaws concern partially signed Bitcoin transactions (PSBTs), the BIP 174 format that lets wallets and signers pass a transaction and its signatures between each other. A Bitcoin fee is simply the value of the inputs minus the value of the outputs, so if software undercounts an input, the fee looks smaller than it really is.
In the first bug, signing and fee accounting could read different values for the same input. Signing used the full previous transaction, while the fee calculation preferred a conflicting record with a smaller amount. The software could therefore approve the real transaction while checking the wrong fee. In a demonstration on version 7.0.1, the actual fee was 900,000,000 satoshi (9 BTC), but the library reported 200 satoshi, the signature still verified and no excessive-fee warning fired.
The second bug involves finalized inputs where both value records are missing. The calculator counted those inputs as zero, and an already signed PSBT imported from another party could reach that calculation without another signing step. The advisory’s example shows a true fee of 91,000 satoshi reported as 1,000 satoshi.
Who is affected
The risk sits with applications that import these packages and trust bitcoinjs-lib’s fee number or its excessive-fee safeguard without checking the spent outputs themselves. For the conflicting-record flaw, affected releases are 5.2.0 to 5.2.1, 6.0.0 to 6.1.8 (including 6.1.0-rc.0) and 7.0.0-rc.0 to 7.0.3. The missing-record flaw hits the same v6 and v7 ranges plus 5.1.0 to 5.2.1.
The bugs do not create signatures on their own. A loss only happens if a user authorizes a valid transaction that is then broadcast and confirmed, and the excess value goes to the miner. The patch makes signing and accounting resolve previous outputs the same way, rejects conflicting values, requires an amount for every input and clears cached fees when metadata changes. Developers who cannot upgrade are told to verify every input value independently before trusting a fee.
What it means for traders
If you self-custody, keep your wallet software updated and look closely at the fee and amounts on the signing screen of a hardware wallet before you confirm. Most traders who keep coins on a large exchange are not exposed to this specific library bug, but withdrawal fees and security practices differ a lot between platforms. Our exchange comparison ranks BingX first and OKX second, and our testing method explains how we score security and fees. New to self-custody? Start with our guide on where to buy your first Bitcoin. This is not investment advice.
Related reviews
Sources
News is for information only and is not financial advice. More crypto news
You'll hear it here first
Get crypto news first on our Telegram channel.