Bitcoin Core has disclosed a medium-severity vulnerability that can let a malicious peer stall block processing on affected nodes. Tracked as CVE-2025-62859, the flaw was made public on 10 November 2026 and affects Bitcoin Core versions earlier than 29.2 and 30.0.

The flaw sits in the way a node handles compact blocks, the compressed form of blocks that peers share to speed up syncing. By manipulating the witness data inside a compact block, an attacker can leave a victim node waiting instead of processing new blocks. The fix is already available: operators running versions 29.2 or 30.0 are protected.

How CVE-2025-62859 works

When a node receives a compact block, it rebuilds the full block from the compressed data and then checks the witness data that proves the transactions are valid. The problem is the order of those steps. According to the Bitcoin Core security advisory, the affected node clears its download state after reconstructing the compact block but before it verifies the witness data.

If that verification then fails, the node asks the same peer for the full block and waits for a 10-minute timeout. Because the download state has already been cleared, the node cannot simply move on to another peer. The stall can be repeated again and again, provided the attacker controls three of the victim's high-bandwidth peers, or if the victim is running in -blockonly mode, which limits how it connects to the network.

The vulnerability was discovered by Eugene Siegel, who reported it to the project under its responsible disclosure process. Bitcoin Core rates it as medium severity. It does not let an attacker steal funds or rewrite the blockchain; its effect is to slow or stop a node from keeping up with new blocks.

Who is affected and what to do

Any Bitcoin Core node running a version earlier than 29.2 or 30.0 is affected. That covers a large share of the network's full nodes, which relay transactions and blocks and keep an independent copy of the blockchain. Node operators should upgrade to version 29.2 or 30.0, both of which contain the fix.

Operators who cannot upgrade immediately can reduce their exposure by avoiding -blockonly mode and by keeping a diverse set of peer connections, since the attack needs control of several of a victim's high-bandwidth peers to repeat indefinitely. There is no indication that the flaw has been exploited in the wild; it was disclosed through the project's own security process.

Part of a wider disclosure programme

The disclosure comes as Bitcoin Core works through a set of vulnerabilities fixed in version 30.0. In late October, the project disclosed three flaws found by an AI-assisted scan of its code, including one that could crash nodes running on Windows, macOS and BSD systems. At the time, developers said three further medium- and high-severity flaws fixed in version 30.0 would be disclosed in November, once operators had time to upgrade.

CVE-2025-62859 fits that pattern: the fix shipped first, and the public description followed once updated versions were available. The approach reflects Bitcoin Core's revised disclosure policy, which aims to publish details of easily discoverable bugs more quickly rather than holding them back for months while users upgrade.

For anyone running a Bitcoin node, the message is straightforward. Check the version, and if it is older than 29.2 or 30.0, update now. A stalled node may not lose money, but a node that cannot keep up with the chain cannot do its job of verifying transactions and relaying blocks to the rest of the network.