Polygon discloses security vulnerabilities patched in Austin and Kyoto hard forks

Aug 29, 2026

Polygon Labs has disclosed several security vulnerabilities that it quietly patched via two coordinated hard forks, Austin on Bor v2.10.0 and Kyoto on Heimdall v0.11.0, before public disclosure. The upgrades resolved critical denial-of-service, resource-exhaustion, and consensus-hardening risks on the Polygon PoS network. No mainnet disruptions or active exploits were observed. Node operators running pre-fork binaries have fallen out of consensus and must upgrade to rejoin the canonical network.

Austin hard fork security patches

▪The Austin hard fork upgraded the Polygon Bor execution client to version v2.10.0, activating at Amoy testnet block 44,120,000 and Polygon PoS mainnet block 91,949,700.
▪The Austin hard fork introduced explicit per-block gas bounds to limit un-metered L1-to-L2 state-sync events that could otherwise slow block processing and stall the chain.

Kyoto hard fork security patches

▪The Kyoto hard fork upgraded the Polygon Heimdall consensus client to version v0.11.0, activating at Amoy testnet height 42,252,000 and Polygon PoS mainnet height 51,533,000.
▪The Kyoto hard fork added a byte-level pre-scan enforced at mempool admission and on the consensus path to prevent deeply nested google.protobuf.Any transactions from imposing expensive decode loads on validators.
▪The Kyoto hard fork bundled smaller hardening fixes, including a cap on fee-coin counts, normalized checkpoint signature recovery bytes, and milestone range votes bound to the signed parent hash.

Bor denial-of-service vulnerabilities

▪The Bor execution client vulnerabilities addressed by the Austin hard fork included two denial-of-service paths that could slow block processing or cause nodes to crash.
▪The Austin hard fork removed the Bor TxDependency wire field, an un-capped parallel-execution hint that a malicious block producer could use to crash peer nodes with oversized data blobs.

Heimdall consensus layer flaws

▪The Heimdall consensus client suffered from byte-level nesting vulnerabilities in how it handled protobuf Any messages, which could allow cheaply-crafted transactions to disrupt consensus messaging between validators.
▪The Kyoto hard fork patched Heimdall consensus flaws spanning ABCI, milestone, bor, stake, topup, clerk, and bridge processing to secure checkpoint finality and milestone accounting.

Private deployment disclosure strategy

▪Polygon Labs deployed the Austin and Kyoto hard forks privately and validated them on the Amoy testnet before mainnet activation and subsequent public disclosure.
▪Polygon Labs published a community forum post detailing the technical aspects of the security releases on August 27, 2026.
▪Polygon Labs reported that no mainnet disruptions or active exploits of the Bor and Heimdall vulnerabilities were observed prior to the public disclosure.

Node upgrade requirements

▪Bor v2.10.0 is mandatory for all Polygon PoS nodes, and Heimdall v0.11.0 is mandatory for all validators and full nodes, requiring only binary upgrades with no state migration.
▪Polygon PoS node operators running pre-fork binaries past the activation heights have fallen out of canonical consensus and must upgrade and roll back to resynchronize.