eMudhra/emSign CA compromise (October 2026): what Cloud SDK Node.js Libraries developers need to do
Maintainers usually reply within 2 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Newbie friendliness
- 10/100
- Issue type
- Documentation
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- grpc, node.js, typescript
Research direction
The issue names the Node.js runtime trust store and the deprecated grpc npm package as affected. Start by checking whether this repository controls either trust store; the issue directs affected applications to upgrade Node.js or migrate to @grpc/grpc-js. Done means following that guidance; the issue is locked, so questions require a new issue.
Written by the indexing model from the issue text.
Description
Summary
Eight eMudhra (emSign) intermediate CA certificates have recoverable private keys (Mozilla bug 2083449). Clients whose trust store still contains emSign ECC Root CA - G3, emSign Root TLS CA - G3 or AAA Certificate Services can be impersonated by an on-path attacker.
The following packages and trust stores are affected
- The Node.js runtime's built-in root certificate store.
- The deprecated native
grpcnpm package, which bundles a root store and will not be updated.
You can take the following actions to resolve these issues
- Upgrade Node.js to 26.12.1, 24.22.1 or 22.23.4 or later.
- If your application still uses the deprecated
grpcnpm package, migrate to@grpc/grpc-js.
Google Cloud Security Bulletin: GCP-2026-075.
This issue is locked. Please open a new issue for questions.
- Dominant language
- TypeScript
- Stars
- 12.3k
- Forks
- 2k
- Avg merge
- 3d 10h
- Merged PRs (30d)
- 9
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from googleapis/google-api-nodejs-client
-
Difficulty 1/5 Under an hour Newbie friendliness 86/100
googleapis/google-api-nodejs-client#4064 ·
Maintainers usually reply within 2 days
-
Difficulty 4/5 1-2 days Newbie friendliness 5/100
googleapis/google-api-nodejs-client#4067 ·
Maintainers usually reply within 2 days
-
Difficulty 5/5 Over a week Newbie friendliness 1/100
googleapis/google-api-nodejs-client#4063 ·
Maintainers usually reply within 2 days
-
Difficulty 5/5 Over a week Newbie friendliness 10/100
googleapis/google-api-nodejs-client#4061 ·
Maintainers usually reply within 2 days
-
Difficulty 5/5 Over a week Newbie friendliness 32/100
googleapis/google-api-nodejs-client#3932 · 1 comment ·
Maintainers usually reply within 2 days
All issues in googleapis/google-api-nodejs-client
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
pieterjanscheir/belgica#201 ·
Maintainers usually reply within 1 day
-
accessibility
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
numerique-gouv/lasuite-landingpage#311 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
oxc-project/tsgolint#1362 ·
Maintainers usually reply within 1 day
-
bug external xai
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
langchain-ai/langchain#41854 ·
Maintainers usually reply within 1 day
-
ready-for-agent
Difficulty 1/5 1-3 hours Newbie friendliness 72/100
nemchik/biome-plugin-suitescript#137 ·
Maintainers usually reply within 1 day