Bitcoin Core has publicly disclosed three security vulnerabilities that were fixed in releases during October 2025, including a high-severity flaw that could stop an affected mining node from building valid block templates after a chain reorganization. The advisories were published on November 10, 2026, after the last vulnerable 29.x release reached end of life. The disclosures are important for node operators, but they do not report a newly discovered active attack or a current emergency patch.
Bitcoin Core’s high-severity flaw affected block templates
The most serious issue, CVE-2025-62861, affected Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1. During a chain reorganization, a mempool rule intended for transaction relay could incorrectly run while previously confirmed transactions were being restored. That could leave the mempool inconsistent, with transactions spending outputs that were no longer available. A node in that state could fail to create a valid block template until it was restarted and its mempool was rebuilt.
Bitcoin Core says the issue was fixed in version 30.0 in October 2025 and backported to versions 29.2 and 28.3. The project credited Niklas Goegge with discovering and responsibly disclosing the flaw. The advisory classifies it as high severity, but the public disclosure does not say that the vulnerability is being exploited now.
Bitcoin Core also disclosed two medium-severity flaws
CVE-2025-62859 involved compact-block processing. Under certain conditions, a malicious peer could cause a node to wait up to ten minutes before requesting a block through another path. The project says the problem could be repeated indefinitely if an attacker controlled the victim’s three high-bandwidth peers or if the node used the -blocksonly setting. Bitcoin Core fixed the issue in versions 30.0 and 29.2.
CVE-2025-62860 involved incoming Tor connections receiving whitelist permissions when a configured IP range matched the Tor proxy. The optional -whitelist setting relaxes some denial-of-service limits and privacy protections for trusted peers. Bitcoin Core said thousands of reachable mainnet nodes had configurations that could whitelist incoming Tor connections, while nodes that did not use the non-default setting were not affected. Fixes shipped in versions 30.0, 29.2 and 28.3.
Why Bitcoin Core disclosed the flaws in November
The project publishes vulnerability details according to severity and release status. Its policy says medium- and high-severity issues are normally disclosed two weeks after the last affected release reaches end of life. The final vulnerable 29.x release reached that point on October 27, 2026, and the three advisories followed on November 10. The fixes themselves were already available in maintained releases a year earlier.
This timing is why the disclosures should not be described as three fresh zero-day attacks. They give operators and researchers the technical detail after fixes have been available and the vulnerable release line has ended support. The distinction is important for accurate risk reporting and for avoiding unnecessary alarm among users whose software is already updated.
What Bitcoin Core node operators should do
Operators should check the exact version they run, review the three official advisories and follow the project’s current release guidance. The affected ranges differ by vulnerability, so a single generic version statement is not a substitute for checking the advisory that matches a node’s configuration. Anyone maintaining a production node should also use a controlled update process, verify release downloads and monitor future security notices.
Bitcoin Core’s disclosures reinforce the value of timely patching and clear end-of-life policies. They also show why node operators should distinguish a public disclosure date from the date a fix became available. For wider context on exchange security and incident response, see GlobalCrypto’s coverage of the Binance security breach.
Sources: Bitcoin Core, CVE-2025-62861, November 10, 2026; Bitcoin Core, CVE-2025-62859, November 10, 2026; Bitcoin Core, CVE-2025-62860, November 10, 2026; Bitcoin Core security advisories and disclosure policy.
