Relay binaries published before 2026-08-20 bind Sphinx anti-replay protection to a mutable packet identifier rather than the packet bytes (fixed in commit 5d4c10e, deployed fleet-wide on the operated mesh on 2026-08-07). A relay running an old binary could be induced to re-forward a captured packet, which weakens replay resistance on that hop. Message content is not exposed (end-to-end encryption is unaffected).

If you installed a relay from the v0.1.0 or v0.3.0 kit: please reinstall with the current kit (v0.4.0) or replace the binaries with the current checksummed release. The operated fleet is already patched; this affects independently-run relays only.

We publish this because operators should never learn about a fixed defect by diffing binaries. Questions: relay@nullwire.xyz.