According to Foresight News, Bitcoin Core publicly disclosed the high-severity vulnerability CVE-2025-62861 on November 10, 2026. The report, published on November 11, 2026, says a flaw in TRUC sibling-transaction eviction during a chain reorganization can leave the mempool inconsistent and stop an affected node from creating a block template until that node is restarted. The fix described in the report predates the public disclosure.
How the failure is described
Foresight News attributes the bug to TRUC sibling-transaction eviction logic that, during a chain reorganization, was not constrained by bypass_limits. When transactions are added again, the node may evict a restored transaction while leaving its descendants in the pool. That inconsistent mempool state can cause miner block-template creation to fail, so the affected node cannot produce blocks until it restarts.
Affected versions and the earlier fix
The versions named as affected are Bitcoin Core 28.0 through 28.2 and 29.0 through 29.1. The fix was released on October 10, 2025 in v30.0 and backported to the 28.x and 29.x branches. The report does not say how widely those fixes had been deployed by the November 2026 disclosure, or whether the bug had been triggered.
Discovery and the patch
Niklas Goegge discovered the vulnerability and disclosed it responsibly. Greg Sanders submitted the fix as pull request #33504.
What the report supports, and what it does not
The stated consequence is operational and local to nodes on the affected releases: after the reorganization path above, block-template construction can fail until restart. That reading assumes an unpatched 28.0–28.2 or 29.0–29.1 node and the TRUC eviction behavior the report describes. The item does not describe a change to consensus validity, an exploitation, a count of exposed nodes, or any price effect. Those points are outside what Foresight News reports.
