npm/@bsv/wallet-toolbox CVE-2026-56744: high 8.7, EPSS 0.38%

`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction

Action: Upgrade @bsv/wallet-toolbox to 2.4.0 or later.

npm i @bsv/wallet-toolbox@2.4.0

Affected

Fixed versions

Sources

• osv: GHSA-36f9-7rg5-cpf8
• nvd: CVE-2026-56744
• https://github.com/bsv-blockchain/ts-stack/security/advisories/GHSA-36f9-7rg5-cpf8
• https://github.com/bsv-blockchain/ts-stack/commit/3a11f6111919245a3090e9f3895cfc4f21a80d28
• https://github.com/bsv-blockchain/ts-stack/commit/5492cabbef4ddc7f60cc49cdf5d8c74ed2e5d949
• https://github.com/bsv-blockchain/ts-stack/commit/5ee60395e78e8b822d9a78efeacc6039c249819b
• https://github.com/bsv-blockchain/wallet-toolbox/commit/ca651b067c0238cd8b1ddd3af225daa503857a07
• https://github.com/bsv-blockchain/ts-stack

CVE-2026-56744 · published 2026-09-24T19:32:00Z · modified 2026-09-24T19:45:04.829800715Z · JSON