BTCPay Server 2.4.5 boosts security and speeds up invoices

BTCPay Server has rolled out version 2.4.5, highlighting enhanced security measures and faster invoice processing. Among the key changes is the addition of protections against Server-Side Request Forgery (SSRF), a vulnerability where attackers trick servers into making unauthorized requests. The update also tightens refund permissions, requiring stricter approval processes to mitigate insider risks and compromised accounts. Privacy improvements include hiding public invoice details one month after issuance, reducing long-term exposure of payment data.

The release, announced on October 5, 2026, with the GitHub tag landing around October 6, 2026, was led by developers Nicolas Dorier and Pavlenex. While the update offers significant security upgrades, users running stores over Tor will need to manually re-enable Tor support after upgrading, as it is no longer enabled by default. Additionally, several older integrations, such as Bitcoin Plus and Trezarcoin, have been retired.

Operators are advised to update through the server settings menu and review their Tor configuration afterward. Developers should pay close attention to the breaking changes and updated Greenfield APIs to ensure compatibility with custom integrations. The release also includes a new command, btcpay-routes, offering more control over Lightning API routes, and reopens Plugin Builder registration with improved sandboxing for enhanced security.