Tor ships back-to-back security releases 0.4.9.12 and 0.4.9.13, fixing high-severity flaws including undetectable guard-led circuit tampering

Tor Project urges immediate upgrades: 0.4.9.12 fixes a flaw letting a malicious guard steer circuit building to attacker-chosen relays undetected, while 0.4.9.13 (released 2026-09-23) ships several more high-severity fixes for relays, clients, and onion…

Two Tor Project security releases were forwarded to the oss-security mailing list on 2026-09-24. Sam James highlighted release 0.4.9.12, whose most significant fix addresses a circuit-building flaw: a malicious guard relay can influence which relays a circuit uses, and Tor does not detect the tampering — directly undermining Tor's path-selection and anonymity guarantees. That post cites no CVE identifier and reports no active exploitation. The second post forwards Tor Project security release 0.4.9.13, issued 2026-09-23, which contains several high-severity fixes affecting all major Tor components — relays, clients, and onion services. The 0.4.9.13 fixes are described as largely originating from an LLM-generated report pipeline, and Tor strongly recommends upgrading as soon as possible; no CVE identifiers appear in the forwarded excerpt. The two reports are complementary and do not conflict.