# Bitcoin Core Discloses Three Patched Bugs, Including One That Let Thousands of Nodes Trust Any Tor Peer

A second, high-severity flaw could stop mining nodes from building block templates after a chain reorganization until someone restarted them, and the project kept both bugs private for about 13 months after fixing them.

- Published: 2026-11-12T05:46:45.461Z
- Canonical: https://polylog.news/crypto/2026-11-12/bitcoin-core-discloses-three-patched-bugs-including-one-that
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CoinDesk](https://www.coindesk.com/tech/2026/11/12/bitcoin-core-reveals-bug-that-made-thousands-of-nodes-trust-any-stranger-on-tor), [Polylog editors](https://polylog.news), [Crypto Times](https://www.cryptotimes.io/2026/11/11/bitcoin-core-discloses-high-severity-bug-that-could-stop-mining-nodes-from-building-blocks/), [TFTC](https://www.tftc.io/cve-2025-62861-bitcoin-core-mining-bug-disclosure)

On Tuesday, Bitcoin Core's maintainers published advisories for three vulnerabilities that they had [fixed in October 2025 and kept private until now](https://www.coindesk.com/tech/2026/11/12/bitcoin-core-reveals-bug-that-made-thousands-of-nodes-trust-any-stranger-on-tor). Bitcoin Core is the reference software that most of the network's nodes run. The disclosure came after the 29.x release line [reached end of life on October 27, 2026](https://www.tftc.io/cve-2025-62861-bitcoin-core-mining-bug-disclosure). Outlets covering the advisories describe that date as the trigger, because the project's policy is to publish such bugs only after the last affected release line stops receiving support.

The most serious of the three, rated High and tracked as CVE-2025-62861, affected how mining nodes build block templates. A block template is the candidate block a miner works on. According to the advisory as reported, nodes running versions 28.0 through 28.2 or 29.0 through 29.1 could [lose the ability to build templates after a chain reorganization involving TRUC transactions](https://www.cryptotimes.io/2026/11/11/bitcoin-core-discloses-high-severity-bug-that-could-stop-mining-nodes-from-building-blocks/). TRUC (topologically restricted until confirmation) is a newer transaction-relay policy. A node in that state stayed stuck until an operator restarted it manually. Developer Niklas Gögge reported the bug on September 26, 2025, and fixes shipped in versions 30.0, 29.2 and 28.3 that October. The French-language channel Goku Crypto News [summarized the risk](https://t.me/GokuCryptoNews/21281) as a mempool malfunction that could prevent some miners from producing new blocks. No outlet reported active exploitation.

The Medium-rated Tor issue reached more machines. CoinDesk reports that [thousands of reachable mainnet nodes](https://www.coindesk.com/tech/2026/11/12/bitcoin-core-reveals-bug-that-made-thousands-of-nodes-trust-any-stranger-on-tor) had been whitelisting incoming Tor connections. Whitelisting is the status a node normally grants only to peers it controls. It removed denial-of-service limits and some privacy protections for any stranger who connected over Tor. The third bug, also Medium, could delay block processing. Coverage disagrees on which CVE number belongs to which of the two Medium issues and on who reported each one, so readers should check the project's advisories index for the mapping. One report estimates that about 9% of reachable nodes still advertised vulnerable versions when the advisories went out. Other coverage puts the practical exposure close to zero, because miners upgrade faster than hobbyist nodes.

## What this means

The exposure sits with mining pools that run older Core versions and with privacy-sensitive node operators who rely on Tor. A stuck template does not create invalid blocks. It stops a pool from mining until a person intervenes, so a deliberate reorganization combined with crafted TRUC transactions could have cost an unpatched pool revenue and briefly reduced the network's hashrate. The Tor whitelisting flaw matters more for the network's structure. Tor exists so that node operators can hide their location, and those were the operators who lost denial-of-service protection. The coordinated, delayed disclosure worked as designed, and the market will not price it. The useful signal is the batch itself. In July 2024 Bitcoin Core began publishing old advisories under its new policy, and each end-of-life date since has released another batch. The desk expects this cycle to continue: more Medium and High bugs disclosed at each end-of-life date over the coming months, with no change to bitcoin's monetary rules. The forward read depends on fixes continuing to ship before anyone exploits the bugs. A Core bug exploited in the wild before its patch, or a consensus-level defect rather than a node-level one, would prove it wrong.

## What to watch

- Whether the share of reachable nodes advertising 28.x and 29.x versions falls over the next few weeks. A slow decline would show how many operators are running software that no longer receives support.
- Whether Knots, btcd and other alternative Bitcoin node implementations audit their own Tor and template code for the same failure modes. A shared defect class would show that client diversity does not protect against these bugs.
- The next end-of-life date in the Core release schedule, which under the current policy sets when the next batch of private advisories can be published.