Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Short answer: available security disclosures do not establish a specific browser exploit that was patched in Eclair. They do show that Eclair exposes a password-protected HTTP API with state-changing commands, so an API reachable by an untrusted browser or the public internet is a serious control risk. Separately, Eclair fixed a critical preimage-extraction flaw in version 0.12.0 and later disclosed denial-of-service issues fixed by the 0.14.0 upgrade guidance.
What is—and is not—confirmed
The headline claim combines two different questions: whether a malicious website can make a browser send commands to an Eclair node, and which Eclair release fixes that specific weakness. The available technical record confirms Eclair’s API design and several unrelated security fixes, but it does not identify a primary advisory that proves the browser-command exploit or names a release that patches it.
As an Amazon Associate I earn from qualifying purchases.
Eclair’s official API documentation describes HTTP form-data requests, JSON or simple-string responses, and HTTP Basic authentication using a configured password. The API includes state-changing POST methods such as /connect, /disconnect, and /sendonionmessage. Those endpoints make API exposure a high-impact security boundary even without a browser-specific vulnerability: anyone who can successfully authenticate and reach the service may be able to alter peers or send messages through the node.
HTTP Basic authentication does not by itself make a browser-facing endpoint safe. Operators must also control network reachability, browser access, credential handling and the way requests are proxied. The documentation establishes the authentication requirement; the recommendation to keep the API away from untrusted browser networks follows from the API’s state-changing capabilities.
#1 Best Overall
Verified Eclair fixes and their affected versions
| Issue | Impact and access path | Affected releases | Recommended fix |
|---|---|---|---|
| Preimage-extraction vulnerability | Force-close monitoring checked only HTLCs in the node’s local commitment. An attacker could exploit an older commitment state to steal funds if the preimage was missed. | Eclair 0.11.0 and below | Upgrade to Eclair 0.12.0 or later. |
| Denial-of-service vulnerabilities | Availability attacks disclosed in September 2026; the disclosure concerns Eclair itself rather than a confirmed browser-to-HTTP command path. | Eclair 0.13.1 and earlier | Upgrade to Eclair v0.14.0 or later, following the disclosure’s guidance. |
Matt Morehouse published the preimage-extraction disclosure on September 23, 2025. It describes a long-standing logic error in force-close monitoring, not a web-origin attack. The later September 2026 disclosure covers two denial-of-service bugs in 0.13.1 and earlier. Neither disclosure should be presented as proof that a malicious website can invoke Eclair API commands.
Why an exposed API still matters
State-changing methods are a control surface
/connect, /disconnect and /sendonionmessage are POST operations that change node behavior or trigger network activity. A stolen API password, an overly broad reverse-proxy rule or an unintended network path could therefore let an intruder manipulate connections or send messages. The practical risk is control of the node’s management interface, not merely disclosure of status data.
Rank #2
Browser reachability is different from Lightning peer access
A browser-origin attack would require a web page to reach the API through the operator’s network path and satisfy whatever authentication and browser protections are in place. That is a different access model from exploiting a Lightning peer protocol or channel state. Until a primary advisory documents the browser issue, do not assume that upgrading to 0.12.0 or 0.14.0 specifically closes it; those versions address the separate vulnerabilities described above.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteActions for Eclair operators
- Check the running release. Record the exact Eclair version, not just the package or container tag. Any installation at 0.11.0 or below should be treated as exposed to the preimage-extraction flaw.
- Upgrade for the documented fixes. Move to at least 0.12.0 for the preimage issue. If you run 0.13.1 or earlier, follow the September 2026 disclosure and upgrade to v0.14.0 or later.
- Inventory API exposure. Determine which interface and address accept HTTP connections, whether a reverse proxy forwards them, and whether firewall or security-group rules allow access from the public internet, shared networks or ordinary user devices.
- Restrict the management path. Bind the API only to an administration interface or private network where practical. Permit access from a narrowly defined operator network rather than from arbitrary browser clients.
- Protect credentials. Use a unique, strong API password, keep it out of URLs and browser history, and rotate it after any suspected exposure. Treat Basic-auth credentials as reusable secrets because the API documentation specifies that authentication mechanism.
- Review proxy and browser behavior. Check that a proxy does not add permissive cross-origin behavior or forward authenticated requests from untrusted sites. Do not assume that a browser’s same-origin policy replaces network-level access controls.
- Monitor for unexpected commands. Review connection changes, onion-message activity and authentication failures. Preserve logs before rotating credentials or rebuilding a node if compromise is suspected.
Architecture and operational context
Eclair is a Scala/JVM Lightning implementation. ACINQ has described a production design that uses AWS Nitro Enclaves and a Ledger Nano for some authentication operations. That architecture illustrates one way to isolate sensitive actions, but it is not evidence that either component is required for every Eclair deployment. A Lightning node remains a hot-wallet system and should be managed as a high-value service.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to interpret the headline safely
Until a primary advisory identifies the browser vulnerability and its patched release, the precise answer to “what Eclair version fixes the browser attack?” is not established. The defensible upgrade baseline is version 0.12.0 or later for the 2025 preimage flaw and v0.14.0 or later for the September 2026 denial-of-service guidance. Independently of those patches, an internet-reachable, Basic-authenticated API should be reduced to the smallest trusted network and monitored as an administrative control plane.
Quick Recap
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
