TL;DR:
Zebra version 7.0.0 incorporates patches for seven vulnerabilities: five classified as high severity and two as medium severity.
The NU7 network upgrade is scheduled to activate at mainnet block 3,543,405, expected around November 5, 2026.
Technical specification ZIP 218 reduces the target block time from 75 to 25 seconds without altering the total daily ZEC issuance or the 21 million coin cap.
The Zcash Foundation published an engineering report this November 3 detailing seven security fixes in Zebra through the release of version 7.0.0, laying the technical groundwork for the activation of the NU7 network upgrade on mainnet.
According to data from the organization, full-node operators must upgrade their software before block 3,543,405 to remain aligned with the network’s consensus chain.
The technical report explains that six of the identified flaws allowed a malicious peer node to halt synchronization, monopolize verification resources, or trigger the erroneous banning of honest peers. The seventh risk vector could force an unexpected shutdown of zebrad , the primary process running the client on servers.
In the internal categorization presented by developers, five advisories received a high-severity rating and two were logged as medium-severity. Among the critical issues are two checkpoint synchronization bugs, insufficient penalties for invalid transparent scripts, computationally expensive signature calculations, and transaction verification capable of saturating processor threads.
Regarding the medium-severity issues, the report notes that one caused Zebra to freeze upon disconnecting a busy peer, while the second led to the eviction of legitimate nodes when relaying transactions whose lock-time condition would be valid in the immediately following block.
One of the technical advisories linked to checkpoints specified that an unauthenticated peer could supply a fake block body. This action left the node undergoing synchronization unable to continue until the system was restarted, because the software erroneously marked the missing blocks as already downloaded.
The Zcash Foundation emphasized in its report that the impact of this vulnerability was strictly limited to operational availability: no invalid blocks were written to disk, no chain fork occurred, and user funds remained intact. Nodes that were already fully synchronized fell outside the affected group.
Database Modifications and NU7 Technical Parameters
The implementation of Zebra 7.0.0 also brings structural changes to local storage. Developers indicated in the GitHub release notes that the node state migrates from format v28 to v29 during the first launch, without requiring a full download from the genesis block.
Since Zebra version 6.x lacks compatibility to read format v29, the engineering team recommended backing up the state/v28 directory before proceeding with the upgrade, warning that reverting to a previous version would require a complete resynchronization.
Likewise, network metrics underwent functional changes. Monitoring dashboards based on individual IP address tags and user agents stopped receiving these identifiers, requiring configuration adjustments across operators’ telemetry systems. Additionally, the foundation established that version 7.0.0 will have an eight-week support window, unlike the standard twelve-week cycle.
At the protocol level, improvement proposal ZIP 218 outlines reducing the average block interval from 75 to 25 seconds. According to design specifications, this acceleration aims to streamline daily payment confirmations, exchange deposits, and cross-chain operations.
To prevent inflationary pressure on supply, the reward issued per mined block is reduced proportionally. The documentation highlights that calculated daily ZEC issuance remains unchanged, preserving the four-year halving schedule and the maximum supply cap set at 21 million units.
NU7 also incorporates a fee reserve: 60% of transaction fees are set aside out of circulation for future mining rewards, while the remaining 40% is collected directly by miners .
In response to feedback raised by miners during the Zcon7 conference in Cancún regarding delays in block construction and propagation, the foundation concurrently released Zebra Ándale (7.1.0-alpha.0) on October 31. According to tests reported by developers in that alpha environment, template generation following intense transaction bursts dropped from over eight minutes to roughly four seconds.
Seeder operators were instructed to deploy the complementary Zeeder v1.8.0 release ahead of activation block 3,543,405 on mainnet, scheduled on the calendar for this November 5.
