Your signal. Your price.
Eclair version 0.14.2 released a critical update to address security exploits from malicious nodes. Q suggests the vulnerability likely targets Eclair's remote procedure call connection with the Bitcoin daemon.
Eclair patched a vulnerability where malicious payment recipients could spoof intermediate routing failures to crash the node's payment lifecycle actor. The release also fixes a bug where Eclair registered incorrect MuSig2 nonces during RBF funding transaction attempts.
Core Lightning, Eclair, and LND merged several critical stability fixes. These updates prevent daemon crashes from oversized HTLC payloads, eliminate channel force-closes caused by duplicate settlement messages, and mitigate out-of-memory vulnerabilities during network state synchronization.
Eclair now fails incoming HTLCs with CLTV expires beyond 2016 blocks to prevent resource consumption, mirroring its existing rule for outgoing HTLCs.
Eclair #33318 resolves a splicing edge case where a reconnecting node would fail to send `splice_lock` after detecting the splice had locked but before receiving the peer's `channel_reestablished` message, which previously led to forced closes.