Lighthouse v8.3.3 is a security patch release that the release notes classify as high priority for all Lighthouse beacon nodes, with operators advised to upgrade as soon as possible. The supplied publication timestamp is November 9, 2026, at 15:12:58 UTC+8.
The release contains no breaking changes. Operators upgrading from v8.2.x or earlier are directed to read the v8.3.0 release notes first.
Which components need priority attention?
The release assigns different update priorities to beacon nodes and validator clients:
| User class | Beacon node | Validator client |
|---|---|---|
| Staking users | High | Low |
| Non-staking users | High | Not applicable |
For staking operators running both components, the high-priority recommendation applies to the beacon node; the validator client is listed as low priority. Beacon nodes used without staking are also assigned high priority.
Security details remain undisclosed
The release notes do not describe the vulnerabilities. They state that details will be disclosed later and that security advisory links will be added once network operators have had time to upgrade.
Sigma Prime also links to its explanation of how it handles vulnerability reports. The release does not provide a specific disclosure date.
Other changes included
Alongside the undisclosed security fixes, the changelog lists:
- Updates to libp2p and crypto-bigint, and a bump of libz-sys to 1.1.31.
- Building slasher tests as C17 to fix mdbx on GCC 15 (#10518).
- Improved accuracy of the
is_infinitymethod. - A fix for the commit hash not appearing in release builds (#10406).
- Counting inbound requests as active until their substream closes, and reclaiming timed-out inbound RPC substreams (#10486).
- Using keys from state as well as the public-key cache.
Packages and signature verification
The release lists pre-built binaries for aarch64 macOS, x86_64 Linux and aarch64 Linux, with PGP signatures. The binaries are signed with Sigma Prime’s PGP key:
15E66D941F697E28F49381F426416DC3F30674B0
A Docker image is also listed as sigp/lighthouse with the v8.3.3 tag.
Original source: Lighthouse v8.3.3 release notes on GitHub.