Repository navigation
Bump Docker base to node:24.22.1-slim and use the OS CA store - #515
Merged
Merged
Conversation
Node 24.19.0's bundled CA store still trusts certificate chains issued under the compromised eMudhra intermediate CA (via emSign ECC Root CA - G3). Node 24.22.1 ships a CA store without the affected roots. Also run Node with --use-openssl-ca so that Node versions installed by `n install auto` during auto-indexing use the patched Debian CA store instead of their own bundled CA lists, which cannot be patched.
christoph-sg
approved these changes
Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The eMudhra intermediate CA key has been compromised. Node 24.19.0, which the current image is based on, still trusts chains issued under it through emSign ECC Root CA - G3 in its bundled CA store. Package installs during auto-indexing (
npm,yarn,pnpm) go through Node, so they accept those certificates even though the Debian trust store in the image (used by curl, git and Python) already rejects them.Changes:
node:24.22.1-slim(index digestsha256:55fb5f5a…d205), whose bundled CA store no longer trusts the affected chains..tool-versionsis updated to match.--use-openssl-catoNODE_OPTIONSso Node uses the patched Debian CA store instead of the CA list compiled into the binary. Auto-indexing runsn install autowhen a repository pins a Node version (.nvmrc,.node-version,engines.node), and those older Node binaries carry their own unpatched CA lists. Without this flag, Node 22.12.0 installed this way accepted both the emSign ECC Root CA - G3 chain and the Comodo AAA Certificate Services cross-signed chain.Test plan
Built the image locally and connected to test hosts serving a leaf certificate under the compromised intermediate, one chaining to emSign ECC Root CA - G3 and one through the Comodo AAA Certificate Services cross-sign. A certificate error counts as a pass. As controls, untrusted-root.badssl.com must fail and registry.npmjs.org must succeed.
https.getCERT_REVOKED) / rejectednpm installyarn addpnpm addn install autoinstalled Node 16.20.2, 18.20.8, 20.11.0 and 22.12.0, Node, npm and yarn reject both chains (UNABLE_TO_GET_ISSUER_CERT_LOCALLY), and registry.npmjs.org and registry.yarnpkg.com still work.npm installandscip-typescript index, on the preinstalled Node and on Node installed byn install auto. The resultingindex.scipis byte-identical to the one produced by the current image, and it contains the dependency symbols.yarn install --frozen-lockfile && yarn build && yarn testinside the new image: 38/38 tests pass.