CVE-2019-16761: Validation Bypass in slp-validate
Summary
CVE-2019-16761: Validation Bypass in slp-validate. Affects slp-validate versions >= 1.0.0, < 1.0.1. Fixed in 1.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The slp-validate package is an npm package used for validating Bitcoin scripts. It is an essential component for ensuring the integrity and consensus of Simple Ledger Protocol (SLP) transactions on the Bitcoin network. The package is responsible for verifying that a given Bitcoin script adheres to the SLP consensus rules. However, versions prior to 1.0.1 are susceptible to a validation bypass vulnerability.
Vulnerability Detail
The validation bypass vulnerability in slp-validate allows an attacker to create a Bitcoin script that deviates from the specified SLP consensus. This discrepancy in validation results can lead to a hard-fork from the SLP consensus. By exploiting this vulnerability, an attacker can potentially disrupt the integrity and reliability of SLP transactions on the Bitcoin network.
How To Fix
Latest published version: 1.2.3 as of 23 Oct 2026
npm install slp-validate@1.2.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.1
This is the first release that contains the fix.
npm install slp-validate@1.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The validation bypass vulnerability in slp-validate can have significant implications for the integrity of SLP transactions on the Bitcoin network. It is crucial to upgrade to version 1.0.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for slp-validate →
FAQ
The vulnerability allows an attacker to create a Bitcoin script that causes a hard-fork from the SLP consensus, potentially disrupting the integrity of SLP transactions.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will provide real-time monitoring and alerts for open-source vulnerabilities.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of the slp-validate package.
There are no known exploits of this vulnerability at the moment. However, it is crucial to upgrade to the latest version of slp-validate to prevent any potential exploitation.
This vulnerability was discovered and reported by the GitHub Security Lab.
References
Related vulnerabilities
Recent vulnerabilities recorded for slp-validate.
