Core Lightning v26.06.9: Enhancing Stability and Security

Core Lightning has officially released version 26.06.9, a vital update aimed at stabilizing node performance and reinforcing network security. This patch arrives shortly after a regression in version 26.06.8 was identified, which inadvertently caused payment delays and communication bottlenecks on busy nodes. By addressing these technical hurdles, the update ensures that node operators can maintain efficient channel traffic without compromising the safety of their funds.

Eliminating Performance Bottlenecks and Protecting Funds

The primary focus of this release is a fix for a message-budgeting error that previously throttled peer interactions. In the prior version, routine pings and onion messages were incorrectly counted toward a CPU budget intended for gossip queries, leading to unnecessary delays for high-traffic operators. Additionally, v26.06.9 introduces a critical safeguard for Hashed Time Locked Contracts (HTLCs) during channel shutdowns. By force-closing channels when a payment deadline is reached during a shutdown, the software prevents the loss of forwarded funds that might otherwise occur due to late fulfillment.

Hardening Security and Configuration Controls

Beyond performance improvements, this update strengthens the security framework surrounding node management and authorization. Fixes have been implemented to enforce strict limits on "runes," preventing restricted authorization tokens from creating unrestricted ones or bypassing blacklists. The update also enhances privacy by masking sensitive recovery information and Bitcoin RPC passwords within the list-configuration command output. Furthermore, a vulnerability that allowed for potential configuration injection has been closed, ensuring persistent settings remain secure. Maintainers have urged all users to upgrade immediately, noting that security tests are being temporarily withheld to protect operators from potential exploits during the transition period.