Bitcoin Core Discloses High-Severity Bug That Could Halt Mining Nodes

Bitcoin Core disclosed three security vulnerabilities on Nov. 10, 2026, including a high-severity defect that could leave affected mining nodes unable to produce blocks until restarted. Developers released fixes in October 2025 but withheld technical details under the project’s disclosure process.

The mining vulnerability, identified as CVE-2025-62861, affected Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1. According to the project’s advisory, a chain reorganization could leave a node’s mempool—the collection of transactions awaiting confirmation—in an inconsistent state that prevented successful block-template creation.

The defect involved rules governing version 3 transactions, known as TRUC transactions. During a reorganization, transactions from disconnected blocks return to the mempool, but transaction-replacement logic incorrectly remained active during that process. It could remove a transaction while leaving transactions dependent on it behind.

That inconsistency caused assembled block templates to fail validation, preventing the affected node from producing blocks. Restarting restored a consistent mempool, according to the advisory. The fix prevents the relevant TRUC checks from running when transactions are restored during a reorganization, addressing the underlying failure rather than merely clearing its effects.

A separate medium-severity vulnerability, CVE-2025-62859, could let a malicious peer stall block processing by announcing a compact block with altered witness data. Affected software could then request the block from that same peer and wait through a 10-minute timeout. Under conditions described in the advisory, including attacker control of the victim’s three high-bandwidth peers, the disruption could be repeated indefinitely.

The third vulnerability, CVE-2025-62860, concerned incoming Tor connections receiving permissions intended for trusted peers. Bitcoin Core could apply an address-based whitelist to the Tor daemon’s address, inadvertently extending those exemptions to remote peers connecting through it. Those permissions lifted various denial-of-service limits and privacy protections.

Developers rated the Tor issue medium severity and said nodes without the non-default whitelist setting were never affected. However, software bundles and common configurations had enabled the problematic setting, leading thousands of reachable mainnet nodes to whitelist incoming Tor connections. Patched versions prevent address-based whitelisting of inbound connections received through an onion bind.

The disclosures describe distinct operational risks rather than a single failure affecting every installation. The mining defect concerns block construction, the compact-block defect concerns processing delays, and the Tor issue depends on configuration. Bitcoin Core’s standard policy delays disclosure of embargoed medium- and high-severity vulnerabilities until two weeks after the last affected release line reaches end of life.

The advisories identify Oct. 27, 2026, as that end-of-life date, explaining the timing of publication. For operators, the practical follow-up is to check deployed versions against the affected releases and confirm that fixes are installed. Tor-enabled operators also have a configuration-specific reason to review how trusted-peer permissions are assigned.