GHSA-8986-v76q-8vr2: @keep network/tbtc v2 @keep-network/tbtc-v2 Revealing P2PKH Deposit With Vulnerability
HIGHGHSA-8986-v76q-8vr2 is a HIGH (CVSS 7.5) @keep-network/tbtc-v2 revealing p2pkh deposit with vulnerability (CWE-328: Use of Weak Hash) affecting @keep network/tbtc v2 libraries in the npm ecosystem. The issue involves @keep-network/tbtc-v2 revealing p2pkh deposit with a wrapped p2sh script. Remediation is available by upgrading affected packages to version 1.8.2.
GHSA-8986-v76q-8vr2 at a Glance
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
How to Fix GHSA-8986-v76q-8vr2
To remediate this vulnerability, upgrade all affected @keep network/tbtc v2 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @keep-network/tbtc-v2@1.8.2Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @keep-network/tbtc-v2How to Check if You Are Affected
To determine whether your Node.js application is affected by GHSA-8986-v76q-8vr2, inspect your project dependencies using npm:
npm ls @keep-network/tbtc-v2Analyze the terminal output to locate any version of @keep network/tbtc v2 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.8.2), your application is affected.
Note: The npm ls @keep-network/tbtc-v2 command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-328: Use of Weak Hash, where the product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack). In @keep network/tbtc v2, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-8986-v76q-8vr2 Affected @keep network/tbtc v2 Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@keep-network/tbtc-v2
|
npm |
< 1.8.2
|
1.8.2
|
References
Frequently Asked Questions
What is GHSA-8986-v76q-8vr2?
Which @keep network/tbtc v2 versions are affected?
What version fixes GHSA-8986-v76q-8vr2?
Is @keep-network/tbtc-v2 affected?
What is the CVSS score of GHSA-8986-v76q-8vr2?
What CWE is associated with GHSA-8986-v76q-8vr2?
How can I check npm dependencies for GHSA-8986-v76q-8vr2?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-8986-v76q-8vr2",
"modified" : "2026-03-02T22:09:19Z",
"published" : "2026-03-02T22:09:19Z",
"aliases" : [ ],
"summary" : "@keep-network/tbtc-v2 revealing P2PKH deposit with a wrapped P2SH script",
"details" : "# Overview\n\nP2PKH has 20 bytes just like P2SH. We protect against revealing P2PKH deposits by manually assembling the expected P2SH script in the smart contract and comparing hashes. However, we missed the case when the attacker embeds a valid P2SH inside of P2PKH as an output script. bitcoin-spv library [extracts the P2SH from P2PKH](https://github.com/keep-network/bitcoin-spv/blob/856849612ef49114af18c0f407eaa74afc2ee4be/solidity/contracts/BTCUtils.sol#L610-L612) and we treat it as a valid P2SH output.\n\nThis does not lead to stealing funds but can lead to protocol insolvency.\n\nThe off-chain client handles this case correctly, but the problem is in the optimistic minting bot. The bot assumes that if the funding TX exists on Bitcoin with the right amount and it was successfully revealed, the transaction is valid.\n\nhttps://bugs.immunefi.com/magnus/672/projects/502/bug-bounty/reports/55982\n\n# Steps\n\nSince there is a 24-hour governance delay on upgrading the Bridge smart contract, we are going to pause optimistic minting.\n\n1. Pause optimistic minting.\n2. Deploy new Bridge implementation with Deposit library containing a fix, WITHOUT VERIFYING THE CODE on Etherscan.\n3. Schedule upgrade transaction.\n4. After 24 hours, finalize upgrade.\n5. Unpause optimistic minting.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@keep-network/tbtc-v2"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.8.2"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 1.8.1"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/threshold-network/tbtc-v2/security/advisories/GHSA-8986-v76q-8vr2"
}, {
"type" : "WEB",
"url" : "https://bugs.immunefi.com/magnus/672/projects/502/bug-bounty/reports/55982"
}, {
"type" : "WEB",
"url" : "https://github.com/keep-network/bitcoin-spv/blob/856849612ef49114af18c0f407eaa74afc2ee4be/solidity/contracts/BTCUtils.sol#L610-L612"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/threshold-network/tbtc-v2"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-328" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-03-02T22:09:19Z",
"nvd_published_at" : null
}
}