Bitcoin Core Disclosed CVE-2025-62861, a Reorg Bug That Could Stop Affected Nodes From Producing Blocks

Bitcoin Core publicly disclosed the high-severity vulnerability CVE-2025-62861 on November 10, 2026, according to a PANews report dated November 11, 2026. The bug can make a node’s transaction pool inconsistent during a chain reorganization, so miner block-template creation fails and an affected node cannot produce blocks until it is restarted.

Reported mechanism

PANews attributes the flaw to TRUC “sibling transaction eviction” logic that, during a chain reorganization, was not constrained by bypass_limits. When transactions are added again, that logic can evict a transaction that had been restored while leaving its descendants in the pool. The inconsistent mempool state then causes miner block-template creation to fail. Affected nodes cannot produce blocks until they restart.

The report does not say the bug was exploited, how often a reorganization would hit this path, or how many nodes were running the affected releases.

Affected versions and the earlier fix

Affected versions are Bitcoin Core 28.0 through 28.2 and 29.0 through 29.1.

PANews reports that the fix was released in v30.0 on October 10, 2025—before the November 10, 2026 public disclosure—and backported to the 28.x and 29.x branches. Niklas Goegge discovered the issue and disclosed it responsibly. Greg Sanders submitted the fix as pull request #33504.

What the report does and does not support

This is a client-software condition for block-producing nodes on the listed releases, not a reported consensus-rule change and not a market event. Any effect depends on a chain reorganization interacting with the unpatched TRUC eviction path. The source gives no price data, no node counts, and no forecast. On the evidence given, operators already running the October 10, 2025 v30.0 release or the reported 28.x and 29.x backports are outside the affected ranges named in the disclosure.

Dates in this item are the source’s, not a claim that the disclosure or the fix is new relative to a later reading: the fix date is October 10, 2025; the public disclosure date is November 10, 2026; PANews’s report time is November 11, 2026, 10:23:21 UTC+8.

PANews, November 11, 2026, 10:23:21 UTC+8

Further reading