Lighthouse v8.3.3 was published on November 9, 2026, at 15:12:58 UTC+8 as a high-priority patch containing security fixes. The release notes urge all Lighthouse beacon node operators to upgrade as soon as possible.
Vulnerability details were not disclosed in the release notes. The maintainers said links to security advisories would be added after network operators had time to upgrade. The notice therefore establishes the need to update, but does not explain the vulnerabilities or their potential impact.
Who should upgrade?
The release assigns the following priorities:
| User class | Beacon node | Validator client |
|---|---|---|
| Staking users | High | Low |
| Non-staking users | High | Not applicable |
There are no breaking changes in v8.3.3. Operators upgrading from v8.2.x or earlier are directed to read the v8.3.0 release notes as well.
Other changes in the patch
Alongside the security notice, the changelog lists:
- Updates to
libp2pandcrypto-bigint. - An update to
libz-sysversion 1.1.31 (#10499). - Building slasher tests as C17 to fix
mdbxon GCC 15 (#10518). - Improved accuracy of the
is_infinitymethod. - A fix for the commit hash not appearing in release builds (#10406).
- Counting inbound requests as active until their substreams close.
- Reclaiming timed-out inbound RPC substreams (#10486).
- Using keys from state as well as the public-key cache.
The notes do not identify which of these changes correspond to the undisclosed vulnerabilities.
Downloads and verification
The release lists prebuilt binaries for Apple Darwin on aarch64 and Linux on both x86_64 and aarch64, along with a Docker option under sigp/lighthouse for v8.3.3.
The binaries are signed with Sigma Prime’s PGP key:
15E66D941F697E28F49381F426416DC3F30674B0
Sigma Prime also links to its vulnerability-handling policy.
Original source: Lighthouse v8.3.3 release notes, published November 9, 2026, at 15:12:58 UTC+8.