Nethermind 2.2.2 ships the October 2026 out-of-band .NET security updates for Ethereum node operators
Nethermind 2.2.2 is a patch release on top of 2.2.1 that includes the October 2026 out-of-band .NET security updates (Docker image based on .NET 10.0.14). It has no code, database or config changes and can be installed in place over any 2.2.x version.
Vuln-watch · relayed from an upstream security release; see Source & attribution below
Summary
Nethermind 2.2.2 (released 2026-10-26) is a patch release on top of 2.2.1 that includes the October 2026 out-of-band .NET security updates. The release notes name no specific CVEs and refer to Microsoft's announcement for details of the fixed vulnerabilities.
Affected
- Nethermind (NethermindEth/nethermind) 2.2.x before 2.2.2 built on earlier .NET runtimes
- Fixed in 2.2.2 (Docker image based on .NET 10.0.14)
Impact
The fixed issues are in the .NET runtime, not in Nethermind code; the release notes do not describe impact on Nethermind or exploitation in the wild. Consensus behaviour and fork schedules are unchanged from 2.2.1.
Recommended actions
- Upgrade in place to Nethermind 2.2.2 from any 2.2.x version (Docker: pull the new image tag)
- If running a self-managed .NET runtime, apply Microsoft's October 2026 out-of-band .NET updates
Source & attribution
This 0xCERT advisory relays the Nethermind 2.2.2 release notes: https://github.com/NethermindEth/nethermind/releases/tag/2.2.2. Details may change; refer to the upstream project and Microsoft's advisory for the authoritative record.
OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.
Published 2026-10-26 · last updated 2026-11-02
curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0301/signed.txt | gpg --verify