// tag
Security incidents tagged eMudhra. Newest first.
› Node.js
On Oct 21 2026 Node.js shipped security updates for 22.x, 24.x and 26.x fixing ten vulnerabilities. The headline issue is CVE-2026-111497, a high-severity Brotli decoder out-of-bounds write that can enable remote code execution when attacker-controlled Brotli data is decoded. The same release also fixes TLS hostname/IP bypasses and DNS NUL truncation, and refreshes the bundled CA store for the eMudhra incident.
› eMudhra / emSign Global TLS intermediates; any client shipping Mozilla-style CA stores
Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.
8 eMudhra intermediate TLS certs had private keys of just 3 to 8 bits. Anyone could have used them to mint trusted certs for any site. Browsers have blocked them. Linux distros, containers, IoT, and embedded devices are another story. t.co/yCsyEJsqnO
An update on PHP2Shell and the eMudhra certificate compromise. We've confirmed that Appwrite is not affected by PHP2Shell. Appwrite Cloud is also patched for eMudhra in every region. Here's what we've checked and what self-hosted users should do. 🧵
#TechWithMC | eMudhra to exit global website security certificate business after key-generation flaw Its Indian digital signature and eSign services will continue to operate as usual Read More: t.co/AFxrCdzSlz
A Certifying Authority used the number “4” as a private key. eMudhra’s weak keys could let fraudsters fake your bank’s website, padlock included. We’ve written to eMudhra, the Controller of Certifying Authorities and CERT-In asking for a fix. #eMudhra #Cybersecurity t.co/VTxAGHqi6L
🔐 Node.js security updates are now available! New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues. Review the details and update your systems to stay secure. 🔗 t.co/W4kfzx5lxz #NodeJS #Security
🚨 BREAKING: Node.js just dropped its OWN security bombshell. 4 HIGH-SEVERITY vulnerabilities patched TODAY, including one that could let hackers remotely execute malicious code on vulnerable servers. → 10 SECURITY FLAWS were addressed in today's Node.js release, FOUR rated t.co/k3Vb8WK1eC
+8 more on the incident pages above.
