// tag
Security incidents tagged TLS. Newest first.
› Node.js
On Oct 21 2026 Node.js shipped security updates for 22.x, 24.x and 26.x fixing ten vulnerabilities. The headline issue is CVE-2026-111497, a high-severity Brotli decoder out-of-bounds write that can enable remote code execution when attacker-controlled Brotli data is decoded. The same release also fixes TLS hostname/IP bypasses and DNS NUL truncation, and refreshes the bundled CA store for the eMudhra incident.
› eMudhra / emSign Global TLS intermediates; any client shipping Mozilla-style CA stores
Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.
› GoDaddy / Starfield TLS certificates (DV, OV, EV)
GoDaddy (Starfield) found that 404,607 TLS certificates carried policy information (policy OIDs, CPS URI) that didn't match its own published CP/CPS, which under the CA/Browser Forum Baseline Requirements means they must be revoked within five days. GoDaddy missed the Oct 18 deadline and says the certificates were revoked on Oct 21 2026. Nothing was hacked and no keys leaked, but sites still serving a revoked certificate can show browser warnings or become unreachable until the re-issued certificate is installed.
› nginx
nginx published multiple medium/major advisories fixed in 1.31.7+ and 1.30.6+, including HTTP/3 request-body injection (CVE-2026-95101), TLS session-ticket forgery (CVE-2026-97629), AIO use-after-free (CVE-2026-97205), and buffer overflows in alias/rewrite and map/regex paths. Same-day chatter bundled this with the PHP/Node/GitLab rush for anyone terminating HTTP on nginx.
8 eMudhra intermediate TLS certs had private keys of just 3 to 8 bits. Anyone could have used them to mint trusted certs for any site. Browsers have blocked them. Linux distros, containers, IoT, and embedded devices are another story. t.co/yCsyEJsqnO
An update on PHP2Shell and the eMudhra certificate compromise. We've confirmed that Appwrite is not affected by PHP2Shell. Appwrite Cloud is also patched for eMudhra in every region. Here's what we've checked and what self-hosted users should do. 🧵
#TechWithMC | eMudhra to exit global website security certificate business after key-generation flaw Its Indian digital signature and eSign services will continue to operate as usual Read More: t.co/AFxrCdzSlz
A Certifying Authority used the number “4” as a private key. eMudhra’s weak keys could let fraudsters fake your bank’s website, padlock included. We’ve written to eMudhra, the Controller of Certifying Authorities and CERT-In asking for a fix. #eMudhra #Cybersecurity t.co/VTxAGHqi6L
🔐 Node.js security updates are now available! New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues. Review the details and update your systems to stay secure. 🔗 t.co/W4kfzx5lxz #NodeJS #Security
‼️ GoDaddy is revoking 404,607 TLS certificates after a third party flagged that they didn't match its published certificate rules. t.co/SoNFcuNmJj
+9 more on the incident pages above.
