eMudhra: Compromised Certificate Authorities – Update Node.js and Other Software
The private keys of eight intermediate certificates of the certificate authority eMudhra were trivially guessable – allowing valid TLS certificates to be forged for any website. Browsers already block them; many servers and applications such as Node.js only after an update.
What happened?
Since April 2025, a faulty script at the Indian certificate authority eMudhra generated keys for eight intermediate certificates that had only 256 possible values. Anyone who guesses such a key can issue TLS certificates for any domain that software will trust – and silently read or manipulate encrypted traffic (man-in-the-middle).
The weakness was discovered on October 17. Mozilla, Google Chrome and Apple have since blocked the certificates, and eMudhra has revoked them. According to eMudhra, there is no evidence of misuse so far.
The problem: software with its own certificate store keeps trusting the certificates until it is updated. Node.js responded on October 21; the new versions reject certificate chains containing the affected keys (and update the root certificates to NSS 3.131.1). The same update closes ten further Node.js vulnerabilities, including code execution through the Brotli decoder (CVE-2026-111497) and several bypasses of the TLS hostname check.
Who is affected?
- Node.js applications: APIs, backends, build pipelines, automation and Electron apps.
- Software with its own certificate store: Python (certifi), Go, Java, curl and container images with outdated CA certificates.
- Unsupported versions: Node.js 20 and older no longer receive security updates.
What needs to be done?
- Update Node.js: Upgrade to 22.23.4, 24.22.1 or 26.12.1 and restart running processes – otherwise they keep using the old version. Migrate older versions to Node.js 22 or 24.
- Update other software: Update the operating system's
ca-certificatespackage, Python certifi, Go and Electron apps; rebuild container images. - Review your own certificate configuration: If you run Node.js with
--use-system-caor custom CA bundles, make sure the eMudhra intermediate certificates are no longer trusted there. - Test: If in doubt, use the test pages at emudhra.we-have-a-problem.com to check whether a system still trusts the blocked certificates.
This advisory is for informational purposes. For support in reviewing your applications and certificate chains, contact us.
Ready to know your attack surface?
Tell us briefly about your project. We'll come back with a concrete proposal.
Request a first call