Bitcoin applications using certain versions of the bitcoinjs-lib software library may have displayed or relied on transaction-fee calculations far below the amounts that would actually be paid to miners. The library’s maintainers have released fixes for two flaws affecting partially signed Bitcoin transactions, or PSBTs, according to CryptoSlate.
The vulnerabilities do not independently create valid signatures or transfer funds. A loss would require an authorized transaction to be broadcast and accepted by the Bitcoin network. However, applications that trusted the library’s fee calculation or excessive-fee protection without checking input values could have approved a transaction whose real fee was substantially higher than the software indicated.
What the bitcoinjs-lib fixes address
Bitcoinjs-lib is used to build applications that create, sign and process Bitcoin transactions. The affected transaction format, known as a PSBT, allows transaction details and signatures to be passed between different clients or stages of a wallet workflow. Signing, combining signatures, finalizing inputs and extracting a completed transaction are separate operations, even when a single application handles several of them.
The security disclosures published on Oct. 26 identify corrected versions 5.2.2, 6.1.9 and 7.0.4 for their respective release lines. Developers using the library need to check both the version in their dependency tree and the way their applications validate imported PSBTs.
The underlying issue is important because a Bitcoin transaction fee is calculated as the total value of its inputs minus the total value of its outputs. If software treats an input as being worth less than it really is, the resulting fee can appear artificially small. That can undermine safeguards designed to warn users or applications about an unusually high fee rate.
How the two flaws could misstate fees
The first bug involved conflicting records for the same input. The signing process used the complete previous transaction, while the fee-accounting process could instead favor another record containing a lower value. In that situation, the software could produce a valid authorization for the actual transaction while calculating the fee using the wrong input amount.
The advisory included a demonstration using bitcoinjs-lib 7.0.1. The transaction’s actual fee was 900,000,000 satoshis, while the library reported a fee of only 200 satoshis. The signature was valid, and extracting the transaction did not trigger the default warning for an excessive fee rate.
The second flaw concerned finalized inputs for which both input-value records were absent. The fee calculator treated those inputs as having zero value. Because a PSBT that had already been signed could be imported in this state, the issue did not necessarily require another signing operation.
In the advisory’s hypothetical example, a transaction with a true fee of 91,000 satoshis was reported as having a fee of 1,000 satoshis. Existing scripts and signatures do not by themselves prove the value of an input when that value is missing from the PSBT.
The conflicting-record problem affected versions 5.2.0 through 5.2.1, 6.0.0 through 6.1.8, including 6.1.0-rc.0, and 7.0.0-rc.0 through 7.0.3. The missing-record issue covered the same v6 and v7 ranges, as well as versions 5.1.0 through 5.2.1 in the v5 line.
What developers are being asked to do
The remediation gives signing and fee accounting a common method for resolving previous outputs. It rejects conflicting values or scripts, requires an amount for every input when calculating fees, and clears cached fee and extracted-transaction data after relevant metadata changes or PSBT combinations.
Developers who cannot immediately upgrade are advised to verify the referenced output values independently. They should reject conflicting records before signing or trusting a fee calculation, and confirm the value of every input before relying on the fee or extracting a transaction.
The practical exposure depends on how an application imports and validates PSBT data. The defects do not turn an invalid transaction into a valid one, and excess value in a valid transaction becomes a miner fee rather than creating a new type of Bitcoin balance. The central risk is that software or a user could approve a transaction without recognizing the amount that would be paid.
Moneyiar market picture
Moneyiar data recorded Bitcoin at $80,430.506808014 at 22:39 on Oct. 25, 2026, Tehran time. BTC was down 0.08% over 24 hours and 1.32% over seven days.
Other assets in the supplied Moneyiar snapshot showed mixed performance:
- Nexus (NEX): $0.0000006151, up 1.61% in 24 hours and down 13.97% over seven days, at 22:38 on Oct. 25, 2026.
- Rain (RAIN): $0.0084289407, up 2.54% in 24 hours and down 8.14% over seven days, at 22:38 on Oct. 25, 2026.
- Catizen (CATI): $0.0638818524, down 0.09% in 24 hours and 6.41% over seven days, at 11:43 on Oct. 12, 2026.
These figures are Moneyiar market data at the stated times and are separate from the bitcoinjs-lib security disclosures.
