eMudhra/emSign CA compromise (October 2026): what Cloud SDK Node.js Libraries developers need to do
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- Half a day
- Newbie friendliness
- 8/100
Research direction
This issue is an advisory and is locked, so it does not describe a code change in this repository. The payload names no files or tests. Start by reading the linked Mozilla bug 2083449 and the GCP-2026-075 bulletin to confirm which trust stores are affected. Done would mean confirming whether any package in this repository bundles a root store, and opening a new issue for that question, since this one is closed to discussion.
Written by the indexing model from the issue text.
Description
Summary
Eight eMudhra (emSign) intermediate CA certificates have recoverable private keys (Mozilla bug 2083449). Clients whose trust store still contains emSign ECC Root CA - G3, emSign Root TLS CA - G3 or AAA Certificate Services can be impersonated by an on-path attacker.
The following packages and trust stores are affected
- The Node.js runtime's built-in root certificate store.
- The deprecated native
grpcnpm package, which bundles a root store and will not be updated.
You can take the following actions to resolve these issues
- Upgrade Node.js to 26.12.1, 24.22.1 or 22.23.4 or later.
- If your application still uses the deprecated
grpcnpm package, migrate to@grpc/grpc-js.
Google Cloud Security Bulletin: GCP-2026-075.
This issue is locked. Please open a new issue for questions.
- Dominant language
- TypeScript
- Stars
- 3.2k
- Forks
- 732
- Avg merge
- 3d 7h
- Merged PRs (30d)
- 117
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from googleapis/google-cloud-node
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
googleapis/google-cloud-node#9854 ·
Maintainers usually reply within 1 day
-
pubsub: "Operation attempted on ended Span" when a modack is flushed after the message was ackedOpenapi: pubsub
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
googleapis/google-cloud-node#9853 ·
Maintainers usually reply within 1 day
-
storage: V4 getSignedUrl sorts canonical headers with localeCompare, so they disagree with X-Goog-SignedHeadersPossibly taken @itsrayeedscodespace claimed this 6 days ago. Openapi: storage
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
googleapis/google-cloud-node#9840 · 1 comment ·
Maintainers usually reply within 1 day
-
firestore: getPartitions() emits gax AutopaginateTrueWarning in every processPossibly taken @TheRealDanii claimed this 9 days ago. Openapi: firestore
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
googleapis/google-cloud-node#9736 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 82/100
googleapis/google-cloud-node#9723 ·
Maintainers usually reply within 1 day
All issues in googleapis/google-cloud-node
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
pieterjanscheir/belgica#201 ·
Maintainers usually reply within 1 day
-
accessibility
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
numerique-gouv/lasuite-landingpage#311 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
oxc-project/tsgolint#1362 ·
Maintainers usually reply within 1 day
-
bug external xai
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
langchain-ai/langchain#41854 ·
Maintainers usually reply within 1 day
-
ready-for-agent
Difficulty 1/5 1-3 hours Newbie friendliness 72/100
nemchik/biome-plugin-suitescript#137 ·
Maintainers usually reply within 1 day