Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[Security][Urgent] Upgrade Node.js to release containing eMudhra CA blocklist

Abierto
  • ¿Algo no está bien?
#58 2 comentarios 0 reacciones 1 asignado Ver en GitHub

@coder9io ya está trabajando en esto.

Desde el 20/10/2026.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

coder9io:done security urgent

Priority assessment

Urgent: this published Node APM package runs inside customer applications and exports observability data, putting outbound TLS on a shipped runtime path even though the repository is less recently active.

Why this matters

Node.js historically accepted TLS chains through the compromised eMudhra intermediates because its embedded Mozilla root store did not have browser-style online revocation/blocklist handling. Node merged an SPKI blocklist for all eight compromised intermediates on 20 October 2026, but the change must be backported and released on each active Node line.

The latest public Node releases observed during this audit—v26.12.0, v24.22.0, and v22.23.3—predate the fix and must not be treated as patched merely because they are currently latest.

Repository evidence

  • .github/workflows/build.yml:13 — - uses: actions/setup-node@v2
  • .github/workflows/build.yml:15 — node-version: 18.19.0
  • package.json — Node package/build manifest
  • playground/nest/package.json — Node package/build manifest

Required remediation

  1. Inventory every Node version used by this repository in development, CI, package publishing, container builds, and production runtime.
  2. Upgrade each supported release line to the first Node release whose source contains commit d9a3f3d150f7959f2d448d9a61aa11f5a75aa2b3 (or its official backport). Verify this from Node's release notes/source tag; do not assume an older "latest" tag contains the fix.
  3. If this repository uses an end-of-life major (for example Node 10, 14, 16, or 18), migrate to a supported major that contains the fix instead of waiting for a backport that will not arrive.
  4. Update all applicable pins: Docker base tags/digests, actions/setup-node inputs, .nvmrc, .node-version, tool-version files, package engines.node, release workflows, and documentation.
  5. Rebuild containers, server bundles, CLIs, desktop applications, extensions, actions, and published packages from a clean dependency/base-image cache. Redeploy runtime artifacts through the normal release process where applicable.
  6. Keep TLS verification enabled. Do not use NODE_TLS_REJECT_UNAUTHORIZED=0, rejectUnauthorized: false, broad custom trust roots, or similar bypasses.

Acceptance criteria

  • Every Node execution surface used by this repository is documented in the fixing PR, including CI/build-only usage when there is no production Node runtime.
  • Each selected Node release is proven to contain the upstream SPKI-blocklist fix or an official backport of it.
  • Pinned Node versions, images, workflows, and engine constraints are updated consistently; obsolete majors are removed where applicable.
  • With default TLS verification enabled, Node rejects https://dv-g3b-emudhra.we-have-a-problem.com/ with a certificate-validation error.
  • The same updated Node runtime successfully connects to a normal trusted HTTPS endpoint.
  • Relevant dependency installation, lint, unit, integration, build, packaging, and release checks pass.
  • Any shipped artifact is rebuilt without stale base-image/dependency caches and redeployed or republished where applicable.
  • The fixing PR links this issue and records process.version, the release/backport evidence, TLS-test output, and build/deployment evidence.

Scope note

This issue covers Node's embedded trust-policy fix. Updated host/container CA packages and other affected runtimes or dependency bundles remain separate requirements for the wider eMudhra incident response.

Lenguaje dominante
TypeScript
Estrellas
67
Forks
5
Merge medio
23 h 14 min
PR fusionados (30 d)
2

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de last9/openapm-nodejs

Todos los issues de last9/openapm-nodejs

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.