Bitcoin Core has publicly disclosed CVE-2025-62861, a high-severity vulnerability that could have prevented mining nodes from producing new blocks in the wake of a chain reorganization. The flaw was quietly patched more than a year ago, and no exploitation in the wild has been confirmed. Still, the disclosure highlights how quietly critical bugs can move through Bitcoin's open-source development pipeline before the wider community learns of them. The CVE designation itself comes from the Common Vulnerabilities and Exposures system, the standard registry security teams use to track publicly known software flaws.

The bug behind the mining risk

Bitcoin Core is the reference software implementation that most full nodes and mining infrastructure rely on to validate transactions and build block templates — the candidate blocks a node assembles from its mempool for miners to hash. It is distinct from the Bitcoin network itself: the network continues to operate as long as enough nodes run compatible software, but a defect in Core can still create serious operational problems for the miners who depend on it.

According to the official Bitcoin Core advisory, CVE-2025-62861 was introduced in version 28.0 alongside a feature called TRUC, also known as v3 transaction relay — a relay policy that restricts the structure of certain transactions and their unconfirmed descendants to make fee-bumping of pending transaction chains more dependable. The trigger was a chain reorganization, the process by which the network replaces recently appended blocks with a competing chain, typically when competing block candidates are found close together. During such a reorg, the TRUC sibling eviction logic was not gated on the bypass_limits flag that normally applies when transactions are re-added to the mempool — the node's holding area for validated transactions that are waiting to be included in a block. The consequence: transactions spending outputs that no longer existed could remain in the mempool, corrupting its state and preventing block template creation until the node was restarted.

The practical risk was narrow but meaningful. A mining node running an affected version that encountered a reorg could silently lose the ability to assemble new blocks, forfeiting block rewards until an operator noticed and restarted the process. Because chain reorganizations are a normal, if infrequent, part of Bitcoin's operation, the scenario was not theoretical.

The essential facts of the disclosure:

• Bitcoin Core shipped patches in v28.3, v29.2, and v30.0 for the high-severity bug, which could stall mining nodes after a chain reorganization.
• The risk concerned mining continuity rather than the broader Bitcoin network, and no exploitation was confirmed.
• Node operators and miners running versions 28.0–28.2 or 29.0–29.1 should review the official advisory and upgrade.
• Security researcher Niklas Goegge reported the flaw on September 26, 2025. Developer Greg Sanders opened fix PR #33504 three days later; it was merged on October 2, 2025 and backported — applied retroactively to older supported release lines — across three release lines: v30.0 on October 10, v29.2 on October 14, and v28.3 on October 17, all in 2025.

How a mining interruption could have rippled outward

Miners compete to append new blocks to Bitcoin's chain roughly every ten minutes. When a node cannot build a valid block template, it cannot take part in that competition. A single affected node going offline harms only its operator; a wider failure across many nodes running the same vulnerable software version could, in theory, slow the pace of transaction confirmations for the broader network.

The Bitcoin Core advisory confirmed that no exploitation occurred and that the network showed no disruption during the window in which the bug existed. The episode nonetheless illustrates the operational dependency that miners and node operators have on Core's codebase, particularly when new transaction relay features such as TRUC are introduced.

CVE-2025-62861 was not disclosed in isolation. As Unchained Crypto reported, Bitcoin Core simultaneously disclosed two additional medium-severity vulnerabilities: CVE-2025-62860, in which Tor inbound connections were incorrectly granted whitelist permissions affecting a large number of mainnet nodes, and CVE-2025-62859, in which a malicious peer could stall block processing through compact block abuse. Compact blocks are a bandwidth-saving relay format in which nodes exchange short references to transactions rather than full block data. All three fixes had already shipped before the November 10, 2026 disclosure date.

Reaction across the crypto community on X was measured, with most commentators noting that the patches had been available for over a year. In a post on X, @TFTC21 wrote that the worst bug, rated High, could leave a mining node unable to build blocks after a reorg until it was restarted, and urged anyone still running anything older than 29.2 or 30.0 to be aware.

A long embargo — and a new disclosure policy

Bitcoin Core held the public disclosure for approximately 396 days after the fixes shipped, waiting specifically until the vulnerable 29.x release line reached end of life on October 27, 2026 — the point at which a release stops receiving security updates. That interval is notably long even by the project's own historical standards for responsible disclosure. Embargoes of this kind are a fixture of coordinated vulnerability disclosure, the practice of withholding technical details until affected users have had a realistic window to upgrade.

The timing also coincides with a policy update from Bitcoin Core. The project now intends to disclose vulnerabilities that are discoverable by AI tools immediately after patching, rather than holding them under an extended embargo. As Decrypt reported, the shift reflects growing concern that large language models could assist malicious actors in rediscovering known flaws from patch diffs before operators have had time to upgrade.

What node operators, miners, and users should do next

Operators running Bitcoin Core versions 28.0, 28.1, 28.2, 29.0, or 29.1 are running software that contains the high-severity mining-node flaw. The fixed releases are v28.3, v29.2, and v30.0. Node operators and mining infrastructure teams should review the official CVE advisory and their internal deployment procedures before upgrading, since any major node software update carries its own operational risk and should be tested in staging environments first.

Users who do not operate Bitcoin Core directly or manage mining infrastructure have no immediate action to take. The Bitcoin network itself was not disrupted, and transaction confirmations were not affected during the period the vulnerability existed.

The broader security picture for Bitcoin infrastructure has drawn attention recently, as high-profile security breaches in the crypto industry have kept exchange and custody operators on alert. The Bitcoin Core disclosure belongs to a different category of risk, concerning open-source node software rather than custodial systems, but it reinforces the case for timely software updates across all Bitcoin-adjacent infrastructure.

Mining operators in particular should treat the two medium-severity CVEs as seriously as the high-severity one. The Tor permission misconfiguration (CVE-2025-62860) and the compact block stalling attack (CVE-2025-62859) both affected production mainnet nodes and were patched in the same release cycle. Running the latest supported release addresses all three simultaneously.

The new AI-discoverable-bug disclosure policy from Bitcoin Core signals that future patch cycles may move faster from fix to public announcement. For mining operations and node operators, that shortens the window between a patch becoming available and vulnerability details becoming widely known, making rapid upgrade cadences more important than they have historically been.

Editorial note: This article was checked by the CoinWy QC Team before publication on November 11, 2026 for headline accuracy, original value, factual consistency, metadata, commercial disclosure, and authorship claims. CoinWy uses AI for research, drafting, and review; its editorial team is responsible for every article and corrects or withdraws articles when needed.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.