According to The Defiant, Eclair has issued a second security release within five days to address bugs in the Lightning protocol that could allow peers to steal funds under certain conditions. The patch addresses vulnerabilities related to fund transfer mechanisms between nodes.
Node operators can apply the update without needing to close active payment channels. However, the node must be stopped and restarted as part of the upgrade process. This approach enables maintenance while preserving channel connectivity where possible.
The fix targets specific issues in how funds are handled during peer interactions. It does not introduce new functionality or change default behavior beyond resolving the identified risks. The release follows a prior update issued recently, marking the second security-focused version released in this short timeframe.
Operators are advised to upgrade promptly if they manage public or sensitive nodes. No downtime longer than necessary is required; stopping and restarting the node suffices. The change is limited to resolving the stated vulnerability without affecting routine operations.
