CVE-2019-16762: Critical vulnerability in slpjs package
Summary
CVE-2019-16762: Critical severity vulnerability that affects slpjs. Affects slpjs versions < 0.21.4. Fixed in 0.21.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The slpjs package is an npm package that provides functionality for working with Simple Ledger Protocol (SLP) tokens on the Bitcoin Cash (BCH) blockchain. It is used by developers to create, validate, and interact with SLP tokens. The package is widely used in various applications and services that utilize SLP tokens.
Vulnerability Detail
The vulnerability identified as CVE-2019-16762 is a critical severity issue in the slpjs package. It arises from a discrepancy in the parsing of a specially crafted Bitcoin script, which can lead to a hard-fork from the SLP consensus. An attacker can exploit this vulnerability by creating a malicious Bitcoin script to manipulate the validation result of the slpjs package, potentially causing significant disruptions to the SLP ecosystem.
How To Fix
Latest published version: 0.27.11 as of 23 Oct 2026
npm install slpjs@0.27.11Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.21.4
This is the first release that contains the fix.
npm install slpjs@0.21.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the patched version of the slpjs package.
Conclusion
The CVE-2019-16762 vulnerability in the slpjs package poses a critical risk to the SLP ecosystem. It is crucial for developers to upgrade to the patched version (0.21.4 or higher) to ensure the proper validation of SLP tokens and prevent potential hard-forks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for slpjs →
FAQ
The slpjs package is an npm package used for working with Simple Ledger Protocol (SLP) tokens on the Bitcoin Cash (BCH) blockchain.
The vulnerability can lead to a hard-fork from the SLP consensus, potentially causing disruptions to the SLP ecosystem.
To fix this vulnerability, upgrade the slpjs package to version 0.21.4 or a higher version.
All versions of the slpjs package above 0 and below 0.21.4 are affected. Versions 0.21.4 and higher are patched.
You can find more information about this vulnerability in the slpjs GitHub repository and the provided references.
References
Related vulnerabilities
Recent vulnerabilities recorded for slpjs.
