Polygon Labs has issued an urgent notice requiring all Polygon PoS node operators to upgrade their Bor and Heimdall clients following the activation of the Austin and Kyoto hard forks.

The company disclosed that several previously unreported security vulnerabilities were patched through these coordinated upgrades, stressing that nodes still running pre-fork software have already deviated from canonical consensus and must catch up in order to rejoin the network's accepted history. The practice of patching vulnerabilities privately and disclosing them only after coordinated hard forks are live network-wide is a common security pattern among major blockchain teams, since premature disclosure could leave unpatched networks exposed to the very attacks the fixes address.

Austin activated on the mainnet at block 91,949,700 and requires Bor version 2.10.0 or later, while Kyoto activated at block height 51,533,000 and requires Heimdall version 0.11.0. The Kyoto mainnet fork went live on 18 August 2026 at 10:10:31 UTC, and both hard forks were already active on the Amoy testnet at earlier block heights. Polygon emphasized that these are plain binary upgrades requiring no state migration or genesis changes.

However, operators who passed the activation thresholds on outdated clients have fallen out of consensus. They must install the applicable release, roll back to a pre-hardfork point if necessary, and resync under official guidance in order to follow the canonical chain again. For infrastructure providers such as exchanges, RPC services, and dApp backends that query their own Polygon nodes, an out-of-sync node can return stale or incorrect data until the resync is complete.

Security Fixes and Network Hardening

The disclosed vulnerabilities affected Polygon's execution and consensus layers separately.

The Austin hard fork on Bor addressed two denial-of-service vectors in block processing: an unbounded gas consumption path during state-sync events from L1-to-L2 bridge deposits, and an unrestricted TxDependency extra-data field that could crash peers processing oversized blocks.

Because state-sync events execute contract code without a fixed block-level ceiling, sufficiently costly events could slow processing enough to transiently stall the chain. Austin resolved this by imposing a per-block gas limit on state-sync operations and removing the unbounded TxDependency field from the wire format entirely.

Kyoto introduced consensus-hardening measures across Heimdall's transaction and checkpointing logic. The most severe fix limits the nesting depth of google.protobuf.Any messages, preventing malicious actors from constructing cheap transactions that force validators into expensive decode work. This class of fix addresses a well-known asymmetric-cost risk in which a low-fee transaction triggers disproportionately expensive processing on validators, making it a favored vector for denial-of-service attacks on message-decoding layers.

Additional patches cap fee-coin counts before validation scans, normalize checkpoint signature recovery bytes to prevent anchoring failures on Ethereum, and harden milestone voting, producer-downtime handling, and L1-event replay key uniqueness.

Polygon confirmed that none of the vulnerabilities were exploited on mainnet, and the fixes were privately validated on Amoy before public deployment to ensure fleet safety.

All node operators must treat the upgrades as mandatory. Bor serves as Polygon PoS's execution client, while Heimdall manages consensus and checkpointing; maintaining current versions of both is essential for network compatibility and continued participation. Node operators should continue monitoring Polygon's official channels for follow-up disclosures or further client releases.

Source: Metaverse Post