Eclair Releases Patch for Issues Exploitable by Malicious Nodes

ACINQ released Eclair v0.14.5 on Oct. 20, a security patch for issues that malicious nodes could exploit, five days after the Bitcoin Lightning software’s previous release.

ACINQ describes the update as a security-hardening patch and recommends that operators upgrade. It remains compatible with earlier Eclair versions; operators can stop the software, apply the update and restart without closing existing payment channels. The release notice credits Nuhiat-Arefin and mptfire for responsible disclosures.

An earlier release, v0.14.4, addressed a separate browser-facing risk in Eclair’s API. Browsers could attach cached HTTP Basic credentials to cross-site requests, allowing a malicious webpage to send forged commands to a node. The API now rejects requests that carry an Origin header. Command-line use is unaffected, but browser-based control panels need an intermediary backend.

Eclair is a Scala implementation of the Lightning Network, which supports Bitcoin (BTC) payments through payment channels.