ECLAIR 0.14.6 IS ACINQ’S THIRD SECURITY PATCH IN 12 DAYS — SPLICES NOW SPEND ONLY CONFIRMED COINS BY DEFAULT — A PEER COULD SKIP LIQUIDITY FEES AND NEVER GET FLAGGED

Eclair, the Lightning node software from ACINQ, shipped version 0.14.6 at 17:21 UTC on October 27, 2026. It’s the third release in 12 days, after 0.14.4 on October 15 and 0.14.5 on October 20. All three say the same thing: security hardening fixes, and “some of these issues can be exploited by malicious nodes.” This one moved fast. Both code fixes in it were opened as pull requests at 10:29 and 10:35 UTC that day and merged by 15:44 UTC. Both credit the same outside reporter, Erick Cestari.

The bigger fix is about which coins count. A splice resizes a channel with a new on-chain transaction, and the peer can add its own coins to it. A new setting, on by default, makes splices spend only confirmed coins. ACINQ’s own config file says turning it off “is unsafe: our peer may then double-spend an unconfirmed parent after signing.” Then the splice can never confirm, and if Eclair force-closes from it, the payments in flight are at risk. An unconfirmed coin is a promise. A confirmed one is settled.

The second fix is about money owed. A peer can buy inbound liquidity and pay the fee out of payments that haven’t arrived yet. Per the pull request, the peer could pull those payments back before the deal was signed. Eclair then signed the funding transaction with no record of the debt, and “the peer was never flagged, so it could repeat this indefinitely.” Now it gets flagged.

If you run Eclair, your channel coins are only as safe as your node’s checks on what peers hand it. ACINQ says you don’t need to close channels to upgrade: stop, upgrade, restart. Three patches in 12 days is a lot. But every fix is public, credited and tested, so you can read exactly what changed instead of taking the release note’s word for it. At the time of this writing, bitcoin was $80,606.