Eclair Software Patch Blocks Browser-Based Attacks on Bitcoin Lightning Nodes
Eclair Update Stops Malicious Commands via Web Browsers
ACINQ has released a security update for Eclair, which is software used to run a Bitcoin Lightning node. A Lightning node is a computer program that helps process fast, low-cost Bitcoin transactions. The new version, v0.14.4, was released on October 15 to prevent malicious websites from taking control of a user's node through their web browser.
The vulnerability existed because certain web browsers could automatically send saved login details to the node's API. An API, or Application Programming Interface, is a set of rules that allows different software programs to communicate. If a node operator visited a harmful website while their node's API was active, that website could potentially send commands to spend funds or close payment channels.
Important Facts About the Security Release
- The update blocks all API requests that include an "Origin" header, a piece of data typically sent by web browsers.
- For an attack to work, a user must have an active API that their browser can reach and have their login credentials saved in that browser.
- Standard command-line tools like curl and eclair-cli are not affected by this change.
- The patch also includes previously announced repairs for fee losses and signing issues.
New Requirements for Browser Interfaces
According to the Eclair release notes, this security fix changes how legitimate web-based interfaces work. Because the software now rejects requests with an Origin header, these interfaces must now use a separate "backend" or intermediary service to talk to the Eclair node. Previously, some interfaces could connect directly through the browser.
The maintainers noted that while this fix protects against browser-based attacks, it does not replace the need for strong passwords. They also recommend that the node API should only be accessible from the local machine rather than the open internet.
Confirmed Software Changes
The fix for this browser vulnerability was originally merged into the Eclair code in September and is now officially part of the v0.14.4 release. This version also includes fixes for "funding-fee" and "signer" issues that were reported earlier in October. These separate bugs could have caused node operators to lose money through high transaction fees.
How to Secure Your Node
Maintainers recommend that all users upgrade to Eclair v0.14.4. Operators can install the update by stopping the Eclair software, replacing the old files with the new version, and restarting. This process does not require users to close their existing Lightning payment channels, meaning their funds remain active during the update.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.