What the developer wrote
Authored by Matt Corallo
Add 0.1.12 release notes
What changed, and why it matters
This commit adds release notes for rust-lightning version 0.1.12, describing several security fixes. The most serious is an on-chain funds-theft vulnerability for nodes that forward Lightning payments through channels opened by untrusted peers. Other fixes address denial-of-service crashes, including cases involving invalid onion message reply paths, oversized protocol messages, reorgs during on-chain HTLC claims, and peer flooding of channel-open requests. The release notes credit Project Loupe and Kyle W. Santiago for reporting the security issues.
Treat this as a security release announcement. Nodes running affected 0.1.x versions should upgrade to 0.1.12 or later, especially those forwarding HTLCs and accepting channels from untrusted peers. Review the referenced PRs for full technical details and confirm the fixes are present in the deployed build.
Security signals we found
Vendor-described on-chain funds-theft vulnerability for HTLC-forwarding nodes accepting channels from untrusted peers
Multiple vendor-described denial-of-service vulnerabilities in HTLC handling, onion messages, and protocol framing
External security researchers credited by name (Project Loupe, Kyle W. Santiago)
Changelog references specific pull requests for each fix
No source-code patch in this commit; release notes only
Evidence from the diff
The commit only modifies CHANGELOG.md to document the 0.1.12 release. It lists security fixes tied to GitHub PRs #4854, #4850, #4852, #4849, #4848, and #4851. The key security-relevant changes are: (1) a ChannelMonitor bug where equivalent payment_hash/amount HTLCs could be confused during un-revoked counterparty claims, leading to incorrect resolution and potential funds loss; (2) multiple panic fixes in onion message handling, protocol framing, and on-chain reorg batching; (3) input sanitization in UntrustedString/PrintableString; and (4) enforcement of the 50-peer unfunded-channel limit under open_channel flooding. No code changes are present in this commit; the actual fixes are in referenced PRs.
Changed components
rust-lightning CHANGELOG.mdChannelMonitor HTLC resolution logic (PR #4854)Onion message reply path handling (PR #4850)Lightning protocol message framing (PR #4852)On-chain HTLC claim batching during reorgs (PR #4849)UntrustedString/PrintableString sanitization (PR #4848)Unfunded channel peer limit enforcement (PR #4851)Inspect captured patch +33 / −0
### CHANGELOG.md
@@ -33,6 +33,39 @@ Thanks to Project Loupe and Kyle W. Santiago for reporting security issues fixed
in this release.
+# 0.1.12 - Aug 4, 2026 - "Bitcoin's MegaScan"
+
+## Bug Fixes
+ * LDK will no longer generate compact blinded paths with introduction nodes
+ defined by channel references for channels which are closed. This ensures
+ compact blinded paths built by LDK are reachable (#4828).
+
+## Security
+0.1.12 fixes an on-chain funds-theft vulnerability for nodes forwarding HTLCs
+which accept channels from untrusted nodes and several denial of service
+vulnerabilities when accepting HTLCs which merit a response, or in rare cases
+after a reorg when claiming HTLCs on chain.
+ * When processing an un-revoked counterparty's HTLC claim, ChannelMonitor will
+ no longer confuse two HTLCs with equivalent `payment_hash` and amounts,
+ leading to incorrect HTLC resolution (#4854).
+ * LDK will no longer panic when an onion message contains an invalid reply path
+ with the local node as the listed introduction point (#4850).
+ * LDK will no longer panic attempting to send messages which are too large to
+ fit in the lightning protocol's framing, though no known cases of this exist
+ in 0.1 (#4852).
+ * LDK will no longer panic in rare cases when multiple pending HTLCs which
+ expire at different heights are being claimed on-chain and a reorg occurs
+ which changes whether we wish to batch our claim (#4849).
+ * `UntrustedString` and `PrintableString` now filter line- and paragraph-break
+ characters as well as control characters, providing additional robustness
+ especially for log parsing (#4848).
+ * LDK's limit of 50 peers with unfunded channels is now properly enforced when
+ peers flood us with `open_channel` messages (#4851).
+
+Thanks to Project Loupe and Kyle W. Santiago for reporting security issues fixed
+in this release.
+
+
# 0.2.4 - Jun 25, 2026 - "Release the CI"
## Bug FixesWhy this scored 78/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.