SPONSORED PARTNERMEXCExplore global spot and futures marketsEXPLORE MEXC →
CHARTING PARTNERTradingViewAdvanced charts, indicators and market analysisOPEN CHARTS →
TRADING PARTNERGMX via NetNapz TradeTrade decentralised perpetual marketsSTART TRADING →FILECOIN · CLIENT SECURITY · NODE OPERATIONS
Filecoin Lotus 1.38.3 Rebuilds Node and Miner to Reject Distrusted Certificates
Lotus maintainers rebuilt release binaries and Docker images with Go 1.26.10. The security change concerns certificate verification; it does not announce another Filecoin network upgrade.
Published 22 October 2026 · Release event 21 October 2026 · NetNapz Currency Desk 1
Filecoin’s Lotus maintainers published node and miner version 1.38.3 on 21 October. The official release says node, miner and worker binaries, plus Docker images, were rebuilt with Go 1.26.10 to reject known compromised intermediate certificates. Operators using earlier published packages are urged to upgrade.
What the certificate advisory establishes
The Go vulnerability entry GO-2026-6809, published 21 October and also identified as CVE-2026-111943, concerns the standard library’s crypto/x509 certificate verification. Go usually relies on system trust roots, but its advisory identifies narrower cases where trust-store updates require further action. The mitigation rejects known intermediate certificates that are no longer trusted.
The advisory lists affected Go versions before 1.26.10 and the 1.27 line before 1.27.3. It is evidence of a dependency-level trust correction, rather than evidence that a Filecoin operator or wallet was exploited.
A toolchain rebuild with a defined scope
Lotus says there are no other node functional changes from version 1.38.2. The miner version is brought into line at 1.38.3, following its previous 1.38.0 release. Source builds now require Go 1.26.10 or later.
The merged implementation change #13951 raises the module and minimum-version settings, updates the Docker build pin and changes build documentation. Its description says the shared release action uses the module’s declared Go version for Linux and macOS binaries, while Docker uses the pinned toolchain.
Operators jumping directly from 1.37.0 must also review the earlier 1.38.0 warnings covering API permissions, gas limits and gateway limits. Those compatibility changes should be assessed separately from the certificate rebuild.
NetNapz assessment
Assessment: this is an actionable maintenance release for teams responsible for Lotus infrastructure. The next useful evidence is deployment of the rebuilt packages and successful operation of each operator’s dependent services. Publication alone does not establish universal adoption, eliminate every certificate risk or demonstrate any change in FIL demand.
NetNapz checked the official release, Go advisory and merged build change on 22 October 2026. It did not run Lotus, reproduce the certificate issue or independently audit deployed binaries. No live token price or network-performance claim is made.