Lighthouse v8.3.3: security release for Ethereum node operators
Lighthouse v8.3.3 (released 2026-11-09) includes security fixes according to its release notes. Ethereum node operators running Lighthouse should review and upgrade.
Vuln-watch · relayed from an upstream security release; see Source & attribution below
Summary
Lighthouse v8.3.3 (released 2026-11-09) includes security fixes according to its release notes. Ethereum node operators running Lighthouse should review and upgrade.
Affected
- Lighthouse (sigp/lighthouse) versions before v8.3.3
From the release notes
## Summary ⚠️ Lighthouse v8.3.3 is a high-priority patch release containing security fixes. All Lighthouse beacon nodes should be upgraded as soon as possible. Details of the vulnerabilities will be disclosed at a later date. There are no breaking changes in this release. If you are upgrading from v8.2.x or earlier, please read the v8.3.0 release notes. ## Update Priority User Class Beacon Node Validator Client Staking Users High Low Non-Staking Users High --- See Update Priorities for more information about this table. ## Security Content Links to security advisories will be provided here once network operators have had time to upgrade. You can read a blog post about our handling of vulnerabilities here: https://sigmaprime.io/blog/bug-reports/ ## All Changes - Release v8.3.3 - Update libp2p - Bump crypto-bigint - Build slasher tests as C17 to fix mdbx on GCC 15 (#10518)
Recommended actions
- Upgrade Lighthouse to v8.3.3 or later
- Check the release notes for any coordinated upgrade deadline or required configuration change
Source & attribution
This 0xCERT advisory relays the Lighthouse v8.3.3 release notes: https://github.com/sigp/lighthouse/releases/tag/v8.3.3. Refer to the upstream project for the authoritative record and any follow-up security advisories.
OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.
Published 2026-11-09 · last updated 2026-11-09
curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0327/signed.txt | gpg --verify