Mozilla, Google, and Apple have blocked compromised certificates from the certificate authority eMudhra. This action follows the discovery that private keys for eight intermediate certificates were so weak they could be recovered almost instantly. The compromise allows attackers to forge trusted certificates for legitimate websites, undermining the security of encrypted web traffic.

The severity of the breach stems from the simplicity of the compromised keys. According to reports, the private keys were trivially easy to guess, with one key being simply "4". This weakness enabled attackers to issue valid TLS certificates for any domain, posing a direct threat to data integrity and confidentiality for users of affected services.

For developers and system administrators using Node.js, immediate updates are required to mitigate these risks. New versions for Node.js 22.x, 24.x, and 26.x have been released to fix high-risk security vulnerabilities and protect against the compromised certificates from eMudhra. Organizations should verify their runtime environments are updated to these patched versions to ensure continued security.

Sources

• Mozilla, Google, Apple block compromised eMudhra CA certificates
• Node.js fixt eigene und geerbte Sicherheitslücken
• CA-Zertifikate gesperrt: Sicherheitsvorfall bei Zertifizierungsstelle eMudhra