Bitcoin Core Bug: Restart Fix for Broken Mining Nodes

Developers of Bitcoin Core have revealed a high-severity vulnerability that could prevent affected nodes from generating new blocks. The issue arose during chain reorganizations, causing corruption in the node's mempool.

The problem was resolved by developers more than a year ago, though older nodes may still be exposed to risk.

How a Chain Reorg Could Disrupt Bitcoin Block Creation

A block template is a candidate block that a node prepares for miners to work on. Without one, a mining node cannot generate new blocks.

On November 10, Bitcoin Core released an advisory for CVE-2025-62861. The core details are as follows:

• Affected versions: Bitcoin Core 28.0 through 28.2 and 29.0 through 29.1.
• Root cause: A mechanism known as sibling eviction malfunctioned during chain reorganizations.
• Glitch: Nodes could drop a restored transaction while retaining its descendants.
• Result: Remaining transactions spent funds that were no longer available.

"Disclosure of the details of a mempool inconsistency due to TRUC “sibling eviction” rules firing on reorg. A fix was released on October 10th 2025 in Bitcoin Core v30.0. Affected versions are 28.0 to 28.2 and 29.0 to 29.1."

— Bitcoin Core Project (@bitcoincoreorg) November 10, 2026

The flaw involved TRUC transactions, a newer type that permits only one unconfirmed child. With sibling eviction, introduced in version 28.0, a second child paying higher fees can replace the first.

That logic broke down when nodes restored transactions from disconnected blocks. Put simply, the node constructed its next block on an unstable base.

Who Was Vulnerable to the Bitcoin Core Bug?

Primarily miners and pool operators running affected versions. Once the mempool became inconsistent, block template creation failed its validity check.

As a result, the impacted node could no longer produce blocks. A restart was the only remedy, forcing the node to rebuild its mempool from the ground up.

Security researcher Niklas Goegge responsibly reported the flaw on September 26, 2025. Developer Greg Sanders submitted the fix shortly afterward.

Patched versions 30.0, 29.2, and 28.3 were released in October 2025. Bitcoin Core disclosed the details only after the last vulnerable 29.x version reached end of life, which is why developers typically delay information until most nodes have updated.

Two other bugs fixed in version 30.0 were included in the same disclosure batch. One could stall block processing, and another incorrectly granted permissions to inbound Tor connections. The disclosure follows an October batch of three other bugs flagged by an AI-powered scanner called Project Loupe.

Operators still running versions 28.0 through 29.1 should upgrade immediately. Restarting an affected node also restores a clean mempool.