eMudhra/emSign CA compromise (October 2026): what Cloud SDK Node.js Libraries developers need to do
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
This issue is an advisory and is locked, so it does not describe a code change in this repository. The payload names no files or tests. Start by reading the linked Mozilla bug 2083449 and the GCP-2026-075 bulletin to confirm which trust stores are affected. Done would mean confirming whether any package in this repository bundles a root store, and opening a new issue for that question, since this one is closed to discussion.
由索引模型根据 Issue 内容生成。
描述
Summary
Eight eMudhra (emSign) intermediate CA certificates have recoverable private keys (Mozilla bug 2083449). Clients whose trust store still contains emSign ECC Root CA - G3, emSign Root TLS CA - G3 or AAA Certificate Services can be impersonated by an on-path attacker.
The following packages and trust stores are affected
- The Node.js runtime's built-in root certificate store.
- The deprecated native
grpcnpm package, which bundles a root store and will not be updated.
You can take the following actions to resolve these issues
- Upgrade Node.js to 26.12.1, 24.22.1 or 22.23.4 or later.
- If your application still uses the deprecated
grpcnpm package, migrate to@grpc/grpc-js.
Google Cloud Security Bulletin: GCP-2026-075.
This issue is locked. Please open a new issue for questions.
- 主要语言
- TypeScript
- 星标
- 3.2k
- 派生
- 732
- 平均合并
- 3 天 7 小时
- 30 天内合并 PR
- 117
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
googleapis/google-cloud-node 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 66/100
googleapis/google-cloud-node#9854 ·
维护者通常 1 天内回复
-
pubsub: "Operation attempted on ended Span" when a modack is flushed after the message was acked未关闭api: pubsub
难度 2/5 1-3 小时 新手友好度 82/100
googleapis/google-cloud-node#9853 ·
维护者通常 1 天内回复
-
storage: V4 getSignedUrl sorts canonical headers with localeCompare, so they disagree with X-Goog-SignedHeaders可能已有人在做 @itsrayeedscodespace 于 6 天前认领。 未关闭api: storage
难度 2/5 1-3 小时 新手友好度 82/100
googleapis/google-cloud-node#9840 · 1 条评论 ·
维护者通常 1 天内回复
-
firestore: getPartitions() emits gax AutopaginateTrueWarning in every process可能已有人在做 @TheRealDanii 于 9 天前认领。 未关闭api: firestore
难度 2/5 1-3 小时 新手友好度 76/100
googleapis/google-cloud-node#9736 ·
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 82/100
googleapis/google-cloud-node#9723 ·
维护者通常 1 天内回复
查看 googleapis/google-cloud-node 的全部 Issue
相似的 Issue
-
bug UI
难度 2/5 1-3 小时 新手友好度 70/100
wardian-app/Wardian#1746 ·
维护者通常 1 天内回复
-
area: interop area: sip-core v3
难度 2/5 1-3 小时 新手友好度 62/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 62/100
-
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 1 天内回复
-
clawsweeper:fix-shape-clear clawsweeper:queueable-fix clawsweeper:source-repro impact:ux-friction issue-rating: 🦞 diamond lobster no-stale P2
难度 2/5 1-3 小时 新手友好度 72/100
openclaw/openclaw#198551 · 1 条评论 · 1 个 reaction ·
维护者通常 1 天内回复