# Core Lightning Nodes Can Crash After Upgrade if Malformed Gossip Is Stored

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/46800
Published: 2026-11-02T19:12:28.000Z
Updated: 2026-11-02T19:12:28.000Z
Section: Technology

> An April patch blocks new malformed announcements but does not remove a trigger already saved on disk. Core Lightning recommends upgrading to its latest listed release, v26.06.9, published Oct. 7.

A malformed channel announcement stored by a Core Lightning node can make it crash repeatedly at startup, even after an April software fix, security researcher Nishant Bansal said in an Oct. 24 disclosure. The issue affects versions v25.02 through v26.04.

Lightning nodes exchange channel announcements to map payment-channel connections and route payments. In the vulnerable versions, an announcement could list the same previously unknown node as both ends of a channel. Core Lightning’s gossip process saved the message before checking it against the routing graph, where the duplicate node triggered an assertion failure.

Because the bad message was already on disk, the node could encounter it again on restart and crash again. The issue is in Core Lightning’s handling of network gossip; Bansal’s disclosure describes a reproduction on a regtest node, not a confirmed attack against a production node.

Core Lightning merged a fix April 24 and released it in v26.04.1 on April 25. The software now rejects announcements unless node_id_1 sorts before node_id_2. A Lightning specification change merged May 4 also added a receiver-side requirement for canonical node ID ordering.

The software update blocks new announcements of the described kind, but it does not remove a trigger already in the node’s gossip_store. Bansal said an operator whose node is stuck in the crash loop must remove the saved record manually. Core Lightning’s latest listed release, v26.06.9, was published Oct. 7, and the project recommends upgrading to it.

The attack path described by Bansal requires an attacker-controlled, unspent 2-of-2 funding output. The attacker can send the announcement once that output is six blocks deep. Older Core Lightning versions may relay the message without crashing, potentially carrying it to an affected node.

A node that is offline cannot monitor the Bitcoin (BTC) blockchain for a counterparty broadcasting a revoked channel state or for a payment claim with a deadline. Bansal said missing either event could put channel funds at risk. The disclosure documents no resulting loss.