Overview
Important
This is a strongly recommended release for all op-supernode operators. It contains security fixes for the compromised eMudhra certificate authority (CVE-2026-111943) and other Go standard-library security fixes, and support for beacon nodes that publish the slot duration only as SLOT_DURATION_MS.
This release includes the changes tagged as op-supernode/v1.0.5, which was not published separately.
Other changes
L1
- op-supernode now reads the beacon slot duration from
SLOT_DURATION_MSin the beacon node's/eth/v1/config/spec, falling back toSECONDS_PER_SLOT. It can therefore fetch blobs for its virtual nodes from beacon nodes that no longer serveSECONDS_PER_SLOT, which the consensus specs have replaced and which Teku already omits on some custom networks. Nothing changes with beacon nodes that serve either key. If neither key is served, op-supernode fails with an error naming both (#23138)
Security
- The image is built with Go 1.26.10, up from 1.26.8. Go 1.26.10 makes
crypto/x509reject the compromised eMudhra intermediate certificates (CVE-2026-111943), and Go 1.26.9 includes security fixes to thecrypto/tls,html/template,net/http,net/textprotoandospackages (#23290, #23546) - The image's CA trust store (
ca-certificates-bundle20260909-r3) no longer includes the eMudhra emSign Root CA G3, C1 and C3 roots (#23566)
Full Changelog: op-supernode/v1.0.4...op-supernode/v1.0.6
🚢 Docker Image: