A news flash citing a Bitcoin Core security announcement says Bitcoin Core disclosed CVE-2025-62859 on November 10, 2026. The reported medium-severity vulnerability can stall a node’s block processing while it handles compact blocks. According to the report, fixes are included in Bitcoin Core 29.2 and the 30 branch, and the attack can be repeated under specific peer-control conditions or against block-only nodes.

How CVE-2025-62859 can stall a Bitcoin Core node

Available reporting places the flaw in compact-block processing. An affected node clears a block’s download state after reconstruction but before verifying witness data. If the witness-data check fails, the node falls back to requesting the full block, then waits roughly 10 minutes for the timeout window to expire. What may initially appear to be a malformed compact-block event can therefore cause a material delay in block processing.

According to the same reporting, an attacker can repeat the delay by controlling three high-bandwidth peers connected to the target. The flash also says nodes operating in -blockonly mode are particularly exposed, while a secondary SecurityOnline excerpt refers instead to -blocksonly. In either case, the reported exposure is more limited than a claim that every Bitcoin node is equally vulnerable at all times.

The stated practical impact is denial-of-service-style disruption to node operations, rather than theft or an evidence-backed breach of Bitcoin’s consensus rules. Put simply, the flaw causes a target node to spend time waiting through repeated full-block fallbacks instead of processing new blocks normally.

Which releases reportedly fix it

The flash says the fix is included in Bitcoin Core 29.2 and 30. For operators, that provides a clear initial answer: nodes on an older affected branch should be upgraded to the fixed release for that line, rather than treating the disclosure as informational only.

A SecurityOnline excerpt provides a more specific, though still secondary, version picture by naming 30.0, 29.2, and 28.3. This suggests patches were issued for more than one maintained branch, but does not fully establish the official branch-by-branch matrix. Because the underlying Bitcoin Core advisory and release notes were not directly reviewed here, the most supportable reading is that 29.2 and the 30 branch are in the reported fix set, with 28.3 additionally cited by secondary reporting.

Readers should therefore not interpret the shorthand “prior to 29.2 and 30” as proof that every earlier Bitcoin Core version is affected in the same way. The supported conclusion is narrower: the reported fixes cover maintained branches, and the precise release mapping for each branch remains important when operators select an upgrade target.

Why this disclosure appeared now

A CryptoTicker excerpt says Bitcoin Core adopted a faster disclosure process on October 22, 2026 for vulnerabilities considered easy to rediscover. The process pairs point releases for maintained versions with same-day advisories. If accurate, that would help explain why CVE-2025-62859 appeared in reporting alongside several patched branches rather than following a longer embargo cycle.

This context also matters for operators. The central operational task is not to infer a chain-wide emergency, but to match the node’s branch with the reported patched release. Current reporting supports timely maintenance to protect uptime, while some release-level specifics remain subject to confirmation in the official branch notes.