Validation Bypass in slp-validate

Description

Versions of slp-validate prior to 1.0.1 are vulnerable to a validation bypass. Bitcoin scripts may cause the validation result from slp-validate to differ from the specified SLP consensus. This allows an attacker to create a Bitcoin script that causes a hard-fork from the SLP consensus.

Recommendation

Update the slp-validate package to the latest compatible version. Followings are version details:

• Affected version(s): = 1.0.0
• Patched version(s): 1.0.1

References

• GHSA-wmx6-vxcf-c3gr
• www.npmjs.com
• CVE-2019-16761
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Validation Bypass in kind-of - CVE-2019-20149
• Validation bypass is possible in Json Pattern Validator - CVE-2019-19507
• Homograph attack allows Unicode lookalike characters to bypass validation. - CVE-2025-27611
• bson-objectid contains Improper input validation - CVE-2019-19729

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

slp-validate