Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Security][Urgent] Upgrade Node.js to release containing eMudhra CA blocklist

Aperta
  • Qualcosa non va?
#58 2 commenti 0 reazioni 1 assegnatario Vedi su GitHub

@coder9io ci sta già lavorando.

Dal 20/10/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

coder9io:done security urgent

Priority assessment

Urgent: this published Node APM package runs inside customer applications and exports observability data, putting outbound TLS on a shipped runtime path even though the repository is less recently active.

Why this matters

Node.js historically accepted TLS chains through the compromised eMudhra intermediates because its embedded Mozilla root store did not have browser-style online revocation/blocklist handling. Node merged an SPKI blocklist for all eight compromised intermediates on 20 October 2026, but the change must be backported and released on each active Node line.

The latest public Node releases observed during this audit—v26.12.0, v24.22.0, and v22.23.3—predate the fix and must not be treated as patched merely because they are currently latest.

Repository evidence

  • .github/workflows/build.yml:13 — - uses: actions/setup-node@v2
  • .github/workflows/build.yml:15 — node-version: 18.19.0
  • package.json — Node package/build manifest
  • playground/nest/package.json — Node package/build manifest

Required remediation

  1. Inventory every Node version used by this repository in development, CI, package publishing, container builds, and production runtime.
  2. Upgrade each supported release line to the first Node release whose source contains commit d9a3f3d150f7959f2d448d9a61aa11f5a75aa2b3 (or its official backport). Verify this from Node's release notes/source tag; do not assume an older "latest" tag contains the fix.
  3. If this repository uses an end-of-life major (for example Node 10, 14, 16, or 18), migrate to a supported major that contains the fix instead of waiting for a backport that will not arrive.
  4. Update all applicable pins: Docker base tags/digests, actions/setup-node inputs, .nvmrc, .node-version, tool-version files, package engines.node, release workflows, and documentation.
  5. Rebuild containers, server bundles, CLIs, desktop applications, extensions, actions, and published packages from a clean dependency/base-image cache. Redeploy runtime artifacts through the normal release process where applicable.
  6. Keep TLS verification enabled. Do not use NODE_TLS_REJECT_UNAUTHORIZED=0, rejectUnauthorized: false, broad custom trust roots, or similar bypasses.

Acceptance criteria

  • Every Node execution surface used by this repository is documented in the fixing PR, including CI/build-only usage when there is no production Node runtime.
  • Each selected Node release is proven to contain the upstream SPKI-blocklist fix or an official backport of it.
  • Pinned Node versions, images, workflows, and engine constraints are updated consistently; obsolete majors are removed where applicable.
  • With default TLS verification enabled, Node rejects https://dv-g3b-emudhra.we-have-a-problem.com/ with a certificate-validation error.
  • The same updated Node runtime successfully connects to a normal trusted HTTPS endpoint.
  • Relevant dependency installation, lint, unit, integration, build, packaging, and release checks pass.
  • Any shipped artifact is rebuilt without stale base-image/dependency caches and redeployed or republished where applicable.
  • The fixing PR links this issue and records process.version, the release/backport evidence, TLS-test output, and build/deployment evidence.

Scope note

This issue covers Node's embedded trust-policy fix. Updated host/container CA packages and other affected runtimes or dependency bundles remain separate requirements for the wider eMudhra incident response.

Lingua principale
TypeScript
Stelle
67
Fork
5
Merge medio
23h 14m
PR unite (30g)
2

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di last9/openapm-nodejs

Tutte le issue di last9/openapm-nodejs

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.