ACINQ released Eclair v0.14.5 on Oct. 20 to patch issues malicious nodes could exploit in software that carries Bitcoin (BTC) payments over the Lightning Network.
ACINQ's release notice describes the patch as a security-hardening measure and recommends that operators upgrade. Eclair remains compatible with earlier versions. To install the patch, operators stop Eclair, apply v0.14.5 and restart the service; open payment channels can remain active. The notice names Nuhiat-Arefin and mptfire for their disclosures.
Eclair is built in Scala and carries BTC payments through channels on the Lightning Network. Our earlier coverage detailed the Origin-header check Eclair added in v0.14.4. The safeguard followed a browser weakness: a website could use stored HTTP Basic credentials to send commands to a node, even without access to the reply. Browser dashboards must now route calls through a server, while terminal access continues to work.
