-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0248
============================================================

Advisory-ID:  0xCERT-2026-0248
Severity:     High
Published:    2026-10-16T00:34:46.000Z
Updated:      2026-10-16T01:07:19.055Z
Chains:       Ethereum
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0248

Title: Lighthouse v8.2.0: security release for Ethereum node operators

Summary
- -------
Lighthouse v8.2.0 (released 2026-10-16) includes security fixes according to its release notes. Ethereum node operators running Lighthouse should review and upgrade.

Details
- -------
Summary
Lighthouse v8.2.0 (released 2026-10-16) includes security fixes according to its release notes. Ethereum node operators running Lighthouse should review and upgrade.

Affected
- - Lighthouse (sigp/lighthouse) versions before v8.2.0

From the release notes
## Summary
⚠️ Lighthouse v8.2.0 is a high-priority release containing fixes for several security vulnerabilities, as well as optimisations and new features.
All beacon node users should upgrade as soon as practical. Validator client users should review the fee-recipient and graffiti changes below before upgrading.
This release also contains substantial Gloas preparation, Fulu data-availability networking improvements, and new standard API support.
## Upgrade Notes
- - Mandatory fee recipient: Validator clients now refuse to startup when an enabled validator has no suggested_fee_recipient field in validator_definitions.yml and no global --suggested-fee-recipient fallback is configured. This prevents validator income from being lost accidentally.
- - Validator graffiti: Lighthouse beacon nodes now append client version information to user graffiti by default. To opt-out use the --graffit

Recommended actions
- - Upgrade Lighthouse to v8.2.0 or later
- - Check the release notes for any coordinated upgrade deadline or required configuration change

Source & attribution
This 0xCERT advisory relays the Lighthouse v8.2.0 release notes: https://github.com/sigp/lighthouse/releases/tag/v8.2.0. Refer to the upstream project for the authoritative record and any follow-up security advisories.

References
- ----------
- - https://github.com/sigp/lighthouse/releases/tag/v8.2.0
- - GHSA-v927-8q6p-vjx2
- - GHSA-92p8-xfr4-4955
- - GHSA-5hq8-qhww-jm7q
- - GHSA-4w2j-m93h-cj5j

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmroJIUJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmcUmmkKkPEFwhhPzERYjRcEQ60pzqGoC596gv3X
wszZBRYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAACocgD/USmdhPbOlVRnHNdc
geAoopIhbbYcOumy19uH7P+O0TgA/ierltAtFKjrVcW/nY/McpG+iYMc2iqi
CojOyKouWysI
=pCiD
-----END PGP SIGNATURE-----