Bitcoin Core speeds up security fixes as 44% of surveyed nodes run unsupported versions

A network snapshot from Oct. 18 revealed that 3,671 of 8,422 self-reported Bitcoin Core peers (43.6%) ran release lines that had reached end of life, according to data from the Karlsruhe Institute of Technology's Bitcoin network monitor. While nodes on unsupported versions can continue validating blocks correctly, the significant portion running outdated software presents potential security concerns for the Bitcoin network.

Policy Change

Under the previous policy, medium- and high-severity vulnerabilities remained under embargo until two weeks after the last affected release reached end of life, sometimes leaving fixes unpublished for approximately a year. This long embargo period discouraged openly backporting fixes, as the backport itself could reveal the vulnerability.

The new policy allows developers to mark flaws as easily discoverable during triage—a test based on how readily a vulnerability can be found or rediscovered, including by large language models. These fixes will now be distributed to all maintained major lines through point releases, with advisories published alongside them.

Support Cliff

Bitcoin Core maintains its three newest major lines—currently 29.x, 30.x and 31.x. The snapshot found 3,243 peers on 31.x, 712 on 30.x and 635 on 29.x, with 3,671 peers on 28.x and older already unsupported. Once version 32.0 is formally released, 29.x will leave the maintenance window, potentially increasing the percentage of unsupported nodes to 51.1% if the sample remains unchanged.

The measurement covers 8,422 Bitcoin Core peers among 9,691 connected IPv4 and IPv6 peers, excluding Tor-only nodes and privately run infrastructure by exchanges, custodians and miners. Software versions are self-reported, and other implementations like Bitcoin Knots are counted separately due to different maintenance schedules.

Upgrade Challenges

Upgrades remain voluntary, with each requiring operational work. Core 32 switches the default format of partially signed Bitcoin transactions from version 0 to version 2, which has already caused compatibility issues. A user reported on Oct. 14 that files generated by the new graphical wallet failed to import in older Core co-signers in multisignature setups, though a fix was deferred toward 32.1 and RPC users can request the older format.

The new security policy comes as AI-assisted campaigns like Bitcoin Red Team's are producing large volumes of potential vulnerabilities. The first publicly identified use of the new 'easily discoverable' category is still pending as of Oct. 23, with developers acknowledging that mitigations won't have as much 'bake time' in development branches under the faster disclosure approach.