Bitcoin Core has published details of a high-severity vulnerability, CVE-2025-62861, that could cause certain mining nodes to silently stop producing new block templates after a chain reorganization. The issue affected Bitcoin Core 28.0 through 28.2 and 29.0 through 29.1, and was initially reported by Niklas Goegge on September 26, 2025.
The bug was tied to BIP 431 transaction-relay rules for version-three (TRUC) transactions. Under normal conditions, Bitcoin Core enforces a limit of one unconfirmed parent and one unconfirmed child for a TRUC transaction. During a chain reorganization, however, valid transactions from disconnected blocks are re-added to the mempool with a bypass_limits flag that should disable anti-spam checks. The vulnerable code incorrectly allowed sibling eviction to run even when bypass_limits was set.
As a result, a reorg that restored a TRUC parent with multiple children could evict a restored parent while leaving child transactions in the mempool. The mempool would then contain transactions spending outputs whose parent was missing, causing getblocktemplate to fail its internal validity check. Mining software would keep hashing on the last received template, so miners would miss new transactions and fees without any obvious process failure.
Greg Sanders shipped the fix by gating TRUC checks behind bypass_limits. The patch was merged into master on October 2, 2025, and released in Bitcoin Core 30.0 on October 10, 2025, with backports in 29.2 and 28.3. Restarting a node cleared the inconsistent mempool state, but upgrading removed the underlying cause. Versions 29.x reached end of life on October 27, 2026, and the full advisory followed on November 11, 2026, in line with Bitcoin Core's disclosure policy for high-severity issues.
For mining operators, the event highlights that standard uptime monitoring may not detect a node that has stopped delivering fresh work. The advisory recommends tracking the age of the most recent successful template and verifying build versions, while also ensuring backup template sources are not running the same vulnerable release.
