BTCPay Server 2.4.5 tightens security and speeds up invoices

BTCPay Server has shipped version 2.4.5, and the headline features are tighter security and faster invoices. There is one catch worth reading twice. If your store runs over Tor, that support switches off after the update, and you will need to turn it back on yourself. What changed in 2.4.5 The release was announced on October 5, 2026, with the GitHub tag landing around October 6, 2026. Lead developers Nicolas Dorier and Pavlenex are credited with the work. The biggest security change targets something called Server-Side Request Forgery, or SSRF. Picture a receptionist who will phone any number a stranger hands them, including internal lines that should never be called from outside. SSRF works the same way. An attacker tricks a server into making requests on their behalf, sometimes reaching systems that are supposed to stay private. Version 2.4.5 adds protections against that risk across Lightning and LNURL outbound requests, plus invoice webhooks. Put simply, the server is now pickier about where it agrees to send traffic. Refunds also got stricter. The update tightens the permissions required to approve them, which narrows who on a store’s team can send money back out the door. Pr...