What's Happening?
Bitcoin Core has publicly disclosed three security vulnerabilities, identified as CVE-2025-62859, CVE-2025-62860, and CVE-2025-62861. These flaws were fixed in versions 28.3, 29.2, and 30.0, released in October 2025, but are only now being publicly described
following the project's disclosure policy. The most significant vulnerability, CVE-2025-62860, affected thousands of reachable nodes running Bitcoin Core with the anonymity network Tor. This bug caused inbound Tor connections to be treated as trusted peers if the operator had set the `-whitelist` option for an IP range that included the Tor service address. This granted external Tor users the same permissions as internal devices, potentially compromising privacy and availability. The other two flaws include a medium-severity bug (CVE-2025-62859) related to compact block processing, which could stall a node's block processing, and a high-severity flaw (CVE-2025-62861) primarily affecting miners, which could halt block template creation after a chain reorganisation. Users running versions older than 30.0 are strongly advised to update their nodes.
Why It's Important?
These disclosures are crucial for the security and integrity of the Bitcoin network, particularly for users who operate their own nodes. The Tor whitelist bug (CVE-2025-62860) highlights a significant privacy concern, as it could have allowed unauthorized entities to gain privileged access to node information, which is particularly sensitive for users relying on Tor for anonymity. While the flaws did not enable coin theft or creation, they posed risks to node availability and privacy. For home users, a stalled node means delayed incoming payment notifications, impacting their ability to verify transactions promptly. For miners, the high-severity TRUC flaw could have led to operational disruptions, preventing them from creating valid blocks and potentially affecting network stability and transaction confirmation times. The widespread impact of the Tor bug, affecting thousands of nodes due to common industry practices of bundling Bitcoin Core with Tor and default whitelist settings, underscores the need for vigilant software updates and careful configuration management within the cryptocurrency ecosystem.
What's Next?
Users of Bitcoin Core are urged to immediately update their nodes to version 30.0 or later, or to the patched maintenance releases 28.3, 29.2, or 29.5. The project's lifecycle policy maintains the three most recent major versions, meaning older versions will no longer receive security fixes. Beyond updating, users should review their `bitcoin.conf` file to ensure that `whitelist=` entries are narrowly defined and do not inadvertently grant trusted status to unknown Tor connections. For those using all-in-one node packages, it is essential to verify the bundled Bitcoin Core version and update accordingly. The disclosures also serve as a reminder for node operators to separate their private keys from the node itself, ideally using hardware wallets for larger holdings, to mitigate risks even if a node's security is compromised. The Bitcoin Core project will continue its policy of public disclosure for fixed vulnerabilities once the affected release series are no longer maintained.
Beyond the Headlines
The disclosure of these vulnerabilities, particularly the Tor whitelist bug, sheds light on the complex interplay between user convenience, default configurations, and security in decentralized networks. The fact that thousands of nodes were affected due to common bundling practices and default settings highlights a broader challenge in making secure configurations accessible and intuitive for non-expert users. This incident underscores the ongoing tension between ease of use and robust security, especially in a system where individual node operators contribute to the overall network's resilience. Furthermore, the project's transparent disclosure policy, waiting until older versions are no longer maintained, reflects a strategic approach to security that balances informing users with preventing immediate exploitation of newly revealed flaws. This incident could prompt a re-evaluation of default configurations in bundled software and greater emphasis on user education regarding secure node operation and configuration best practices.
