Lighthouse v8.3.3 is a security patch release that urges all Lighthouse beacon node operators to upgrade as soon as possible. The release notes list no breaking changes.
Original publication time: November 9, 2026, at 15:12:58 UTC+08:00.
Who should prioritize the upgrade?
The release assigns the following update priorities:
| User class | Beacon node | Validator client |
|---|---|---|
| Staking users | High | Low |
| Non-staking users | High | Not applicable |
If you are upgrading from v8.2.x or earlier, read the v8.3.0 release notes first.
What is disclosed about the security fixes?
At publication, vulnerability details were not disclosed. The maintainers said security advisory links would be added after network operators had time to upgrade.
Sigma Prime also links to its explanation of how it handles vulnerability reports. The release notice does not provide enough detail to explain the vulnerabilities or assess their specific effects.
Other listed changes
Alongside the security fixes, the changelog lists:
- Updates to
libp2pandcrypto-bigint. - An update to
libz-sysversion 1.1.31 (#10499). - Building slasher tests as C17 to fix an
mdbxissue on GCC 15 (#10518). - Improved accuracy of the
is_infinitymethod. - A fix for the commit hash not appearing in release builds (#10406).
- Counting inbound requests as active until their substreams close.
- Reclaiming timed-out inbound RPC substreams (#10486).
- Using keys from state as well as the public-key cache.
Available downloads and verification reference
The release lists these pre-built archives:
- Apple, aarch64:
lighthouse-v8.3.3-aarch64-apple-darwin.tar.gz - Linux, x86_64:
lighthouse-v8.3.3-x86_64-unknown-linux-gnu.tar.gz - Linux, aarch64:
lighthouse-v8.3.3-aarch64-unknown-linux-gnu.tar.gz
Each listed archive has a PGP signature. The release identifies Sigma Prime’s signing-key fingerprint as:
15E66D941F697E28F49381F426416DC3F30674B0
It also lists Docker version v8.3.3 under sigp/lighthouse. Consult the release’s linked pre-built binaries documentation for download guidance; the notice itself does not provide a complete installation or signature-verification procedure.