Erigon v3.8.0: security release for Ethereum node operators

Summary

Erigon v3.8.0 (released 2026-10-20) includes security fixes according to its release notes. Ethereum node operators running Erigon should review and upgrade.

Affected

• Erigon (erigontech/erigon) versions before v3.8.0

From the release notes

mn storage. Leave --caplin.columns-keep-slots at 0 to follow this window; an explicit value overrides pruning retention and may delete columns the node still needs to serve (#24720) — by @Bruce039 ## Security - Network decoders allocate buffers as data arrives and reject impossible compressed sizes. Tighter bounds on peer queues, transaction packets, and Caplin gossip control messages reduce memory exhaustion risks from hostile traffic (#24374, #24649, #24648, #24392, #24508, #24616) — by @yperbasis, @AskAlexSharov - RPC rejects oversized transactions before decoding. Caplin bounds SSZ committee vectors and rejects invalid validator and slashing indices, preventing excessive allocations and panics. Invalid block access list indices are rejected before execution. The Engine API rejects null withdrawal entries before hashing or building blocks (#24315, #24614, #24615, #24771, #

Recommended actions

• Upgrade Erigon to v3.8.0 or later
• Check the release notes for any coordinated upgrade deadline or required configuration change

Source & attribution

This 0xCERT advisory relays the Erigon v3.8.0 release notes: https://github.com/erigontech/erigon/releases/tag/v3.8.0. Refer to the upstream project for the authoritative record and any follow-up security advisories.