Overview
- Bitcoin Core disclosed on November 10, 2026 that it had publicly documented three vulnerabilities that were quietly fixed and released in October 2025.
- The highest-severity flaw, tracked as CVE-2025-62861, can corrupt a node’s mempool during a chain reorganization and stop a miner from building block templates until the node is restarted.
- CVE-2025-62859 lets a malicious peer manipulate a compact block to stall block processing for about ten minutes, creating a denial-of-service risk for affected nodes.
- CVE-2025-62860 is a Tor-related whitelisting bug in the optional -whitelist setting that granted elevated permissions to inbound Tor peers and affected thousands of reachable nodes.
- The fixes were backported and shipped in October 2025 with no evidence of active exploitation, nodes running Bitcoin Core 30.0 or patched 2025 releases are protected, and operators still on unsupported 28.x–29.x lines should update because faster AI-driven disclosure practices have shortened patch timelines and testing windows.