Eclair released v0.14.4 on October 15, fixing a browser attack vulnerability. This vulnerability allowed malicious web pages to send authenticated commands to the Lightning node API via HTTP Basic authentication cached in the browser, potentially leading to node channel closures or fund transfers. The new version blocks such cross-origin requests by returning HTTP 403 when the API receives an Origin request header. The fix does not affect the normal use of command-line tools (curl/eclair-cli). The official recommendation is for users to upgrade, and the upgrade process does not require closing Lightning channels.