Bitcoin Core Discloses Three Security Flaws Affecting Nodes and Miners

Bitcoin Core disclosed three security vulnerabilities on Nov. 10, 2025, including a high-severity flaw that could halt mining nodes during blockchain reorganizations. None of the bugs allowed bitcoin theft, unauthorized coin creation, or a consensus failure, and developers reported no exploitation in the wild.

Security researcher Niklas Goegge reported the high-severity defect on Sept. 26, 2025. The bug caused problematic transaction eviction behavior during reorganizations, and its consequences were confined to affected node operators rather than the Bitcoin network itself. Developer Greg Sanders introduced a correction that was merged on Oct. 2.

The fix shipped in Bitcoin Core versions 30.0, 29.2 and 28.3 throughout October 2025. Despite the patches, roughly 9% of reachable nodes continued advertising vulnerable versions around the disclosure date, leaving a meaningful share of network infrastructure exposed to operational disruption.

What did the other two vulnerabilities do?

The second flaw, tracked as CVE-2025-62859, carried a medium-severity classification. It involved maliciously constructed compact blocks: an attacker could exploit improper handling of altered transaction witnesses to repeatedly delay block downloads. Under particular network conditions — including compromised high-bandwidth peer connections — the interference could continue indefinitely.

Researcher Eugene Siegel identified that weakness in April 2025, and Gregory Sanders developed the correction, which reached Bitcoin Core versions 30.0 and 29.2.

The third flaw, CVE-2025-62860, exposed a different class of problem involving inbound Tor connections and trusted-peer permissions. When operators configured Bitcoin Core's optional -whitelist setting to include their Tor daemon's address, incoming connections could mistakenly inherit privileges intended for trusted peers. Those exemptions weakened certain denial-of-service safeguards and privacy protections. Bitcoin Core indicated that thousands of reachable mainnet nodes were potentially affected, although standard configurations remained safe.

Why did Bitcoin Core wait until November?

The Nov. 10 announcements followed Bitcoin Core's established disclosure schedule. Developers withheld technical details until the final vulnerable major release line, 29.x, reached end-of-life status on Oct. 27, 2026. Unlike three AI-assisted vulnerability disclosures published on Oct. 28, these three issues followed the conventional embargo process.

For bitcoin miners and node administrators, the distinction between operational bugs and fund-compromising flaws matters directly. The mining vulnerability required specific reorganization conditions, which limited its blast radius to the operators running affected software. A halted mining node loses revenue and delays block propagation even when no coins are at risk.

The episode illustrates how seemingly obscure transaction-handling defects can create tangible operational problems without threatening the network's underlying consensus. Software maintenance therefore remains essential even when vulnerabilities cannot compromise funds.

Node operators still running versions 28.x, 29.x or earlier 30.0 builds face a practical deadline: the vulnerable release lines have now passed or are approaching end-of-life, and upgrades to the patched 30.0, 29.2 or 28.3 releases close the documented attack surface.