Sigma Prime Releases Lighthouse v8.3.3 With Security Fixes, Urges Beacon Node Operators to Upgrade
Key Facts
Sigma Prime released Lighthouse v8.3.3 on November 9, 2026, a high-priority patch update that includes security fixes, according to the official release notes on GitHub. Developers urged all Lighthouse beacon node operators to upgrade "as soon as possible." The notice puts Beacon nodes at the top of the update priority list for users participating in staking and those who are not. By contrast, the release table rated the validator client as low priority for staking users. Sigma Prime did not disclose details of the vulnerabilities in the announcement, saying it would do so later.
The release includes no breaking changes, according to Sigma Prime, distinguishing its stated scope as a security and patch update. The change list includes an update to libp2p and a version bump for crypto-bigint. It also includes improved accuracy for the is_infinity function and a fix for the commit hash not appearing in the release build. The release notes did not link these changes to a supply-chain attack. Developers also did not announce details of the vulnerabilities or any exploitation in the release notes.
Sigma Prime says delaying vulnerability details when issuing a patch is part of its disclosure policy, giving users time to update their nodes before technical information is published. The company says details are added later to release notes and security advisories. In a blog post published on November 5, 2026, it said 54% of 81 closed security reports were valid, and 14% of valid reports were classified as high severity. It also said the average time between reporting a bug and merging a fix was 33 days, compared with a median of 17 days. These figures provide context on the handling and disclosure of reports, without identifying the vulnerabilities addressed by the new release.
Sigma Prime added in the post that Lighthouse had seen 11 releases during 2026 through November 5, most of which featured security fixes. According to the company’s description of its reporting process, a developer typically responds within 24 hours with an initial assessment of the bug’s severity or the report’s validity. After a fix is merged, Sigma Prime retests the proof of concept or uses test networks to verify that the attack no longer works. It said an internal fix may be followed by a public release a few hours later, to shorten the period between publishing the fix and announcing it. The company is now urging Beacon node operators to install v8.3.3, with vulnerability details to be published later.