Besu 26.10.0: security release for Ethereum node operators

Summary

Besu 26.10.0 (released 2026-10-16) includes security fixes according to its release notes. Ethereum node operators running Besu should review and upgrade.

Affected

• Besu (hyperledger/besu) versions before 26.10.0

From the release notes

This release contains security fixes. Operators are advised to upgrade promptly. Details will be published in security advisories on besu-eth/besu after operators have had an opportunity to upgrade. ## Headline: Amsterdam scheduled on Hoodi - The Amsterdam hard fork is scheduled on Hoodi at timestamp 1793036568 (Mon, 26 Oct 2026, 17:42:48 UTC). Hoodi node operators must upgrade before then. [#11531] ## Action required on upgrade - Bonsai database auto-upgrade on first start (DB v4 / archive v3): stores jump-dest analysis alongside code. Takes a few minutes on mainnet, and the DB can no longer be opened by an older Besu afterward. A new besu storage revert-code-format subcommand can roll it back if you need to downgrade. [#11327, #11364] - Default discovery mode is now BOTH (DiscV4 + DiscV5 concurrently). Set --discovery-mode=V4 (or V5) to pin to one. [#11344] - Chain-pruning retent

Recommended actions

• Upgrade Besu to 26.10.0 or later
• Check the release notes for any coordinated upgrade deadline or required configuration change

Source & attribution

This 0xCERT advisory relays the Besu 26.10.0 release notes: https://github.com/besu-eth/besu/releases/tag/26.10.0. Refer to the upstream project for the authoritative record and any follow-up security advisories.