Bitcoin Core Details Three Fixed Bugs, One That Could Stall Miners

Bitcoin Core published details of three security bugs on Nov. 10, including a High-severity flaw that left some mining nodes unable to build blocks after a reorg. All three were fixed more than a year ago.

Anyone still running an old node is the one with the stake here. The fixes shipped in Bitcoin Core 30.0 on Oct. 10, 2025, and in 29.2 on Oct. 14, 2025, according to the project's advisories. The project waited until the last vulnerable release line, 29.x, reached end of life on Oct. 27, 2026, before publishing the details. None of the three write-ups says whether a bug was ever exploited.

How a reorg jammed a miner's block template

A node keeps a mempool, its waiting room for unconfirmed transactions. Version 3 transactions, called TRUC (defined in BIP 431), may have only one unconfirmed parent and one unconfirmed child. Version 28.0 added "sibling eviction," which swaps an existing child for a better-paying one.

During a chain reorganization, when a node drops recent blocks for a competing chain, it puts their transactions back into the mempool. The High-severity advisory (CVE-2025-62861) says sibling eviction kept running during that step. That step evicted restored transactions in some cases, leaving the mempool inconsistent, so a miner's block template failed until the node was restarted. Versions 28.0 to 28.2 and 29.0 to 29.1 were affected.

Two Medium-rated bugs

The second flaw only hit nodes using the optional -whitelist setting, which relaxes limits for trusted peers. Inbound Tor peers show up with the local Tor daemon's address, so whitelisting that range trusted every Tor peer. The advisory says vendor setups led to "thousands of reachable mainnet nodes whitelisting all incoming Tor connections."

The third let a malicious peer stall block processing through compact blocks, a bandwidth-saving way to relay new blocks. If the attacker controlled all three of a node's high-bandwidth peers, or the node ran -blocksonly, the stall repeated with no end, the advisory says.

Unchained noted these are separate from three bugs the project disclosed on Oct. 28.

In our opinion: the date to circle is Oct. 27. Once 29.x stopped getting updates, every node still on 28.x or 29.1 and older is running software with publicly documented flaws. Miners and node-in-a-box vendors carry most of that risk, and the fix has been sitting on the download page for 13 months.