Lighthouse v8.3.1: high-priority release distrusting the compromised eMudhra certificate authority
Lighthouse v8.3.1 updates the client's trusted certificates to mitigate the compromised eMudhra certificate authority. Sigma Prime says all users on all networks should upgrade as soon as practical, especially setups using HTTPS for checkpoint sync, web3signer, or VC-to-BN connections.
Vuln-watch · relayed from an upstream security release; see Source & attribution below
Summary
Sigma Prime released Lighthouse v8.3.1 as a high-priority release that updates Lighthouse's trusted certificates to mitigate the compromised eMudhra certificate authority. The release notes give no further technical detail.
Affected
- Lighthouse (sigp/lighthouse) beacon node and validator client before v8.3.1
- Fixed in v8.3.1
Impact
Per the release notes, the risk concerns HTTPS connections made by Lighthouse, for example checkpoint sync, web3signer, and validator-client-to-beacon-node connections. Update priority: Beacon Node High for staking users, Medium for non-staking; Validator Client High for staking users. The release notes do not report exploitation in the wild.
Recommended actions
- Upgrade Lighthouse to v8.3.1 or later (v8.3.2 is also required for Hoodi)
- Prioritise nodes that use HTTPS for checkpoint sync, web3signer, or VC-to-BN connections
- Users coming from v8.2.x should read the v8.3.0 release notes first
Source & attribution
This 0xCERT advisory relays the Lighthouse v8.3.1 release notes by Sigma Prime: https://github.com/sigp/lighthouse/releases/tag/v8.3.1. Details may change; refer to the original source for the authoritative record.
OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.
Published 2026-10-22 · last updated 2026-11-02
curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0299/signed.txt | gpg --verify