Bitcoin Core discloses three security bugs affecting nodes

Bitcoin Core has published details on three security vulnerabilities that touched miners, node operators and Tor users. Each one was quietly fixed more than a year ago.

The disclosure landed on November 10, 2026. It covers one flaw rated High severity and two rated Medium. Bitcoin Core reported no active exploits for any of them. The issues only matter now for anyone still running software that should have been retired long ago.

What the three bugs actually did

The headline issue is CVE-2025-62861, the one rated High. It affected block template creation during chain reorganizations involving TRUC transactions.

Some quick translation helps here. A block template is the draft block a miner assembles before trying to mine it. A chain reorganization happens when nodes drop a few recent blocks in favor of a competing chain.

Put those together and the bug could stop miners from producing a valid block template. That applied to Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1. The flaw was reported on September 26, 2025.

The second issue, CVE-2025-62860, involves Tor connection whitelisting. Bitcoin Core said the optional -whitelist setting handed trusted permissions to inbound Tor peers. That happened on thousands of reachable nodes.

This one only bit operators using the non-default whitelisting configuration alongside Tor.

The third flaw, CVE-2025-62859, concerned compact block processing. The bug let a malicious peer stall block processing for approximately 10 minutes. That issue was reported in April 2025.

Why the public is only hearing about this now

All three vulnerabilities were backported and fixed in Bitcoin Core releases from October 2025. Bitcoin Core 30.0 shipped on October 10, 2025, with the fixes already in place.

The timing follows the end of support for Bitcoin Core 29.x on October 27, 2026. That was the last version line still affected.

What this means for miners and node operators

For most of the network, the practical impact is close to nil. Anyone running Bitcoin Core 30.0 or a patched October 2025 release has been covered for over a year. No active exploits were reported.

The exposure sits with operators still on unsupported software. Miners running versions 28.0 to 28.2 or 29.0 to 29.1 remain open to the template bug.

Node operators using the -whitelist flag with Tor should check their configurations. The fact that thousands of reachable nodes ran this non-default setup is worth noting.