--- id: "GHSA-26q8-h657-pf84" page: "https://infrastack.ai/live/GHSA-26q8-h657-pf84" kind: "vulnerability" aliases: ["GHSA-26q8-h657-pf84"] title: "Bundled root certificates trust compromised eMudhra (emSign) intermediate CAs" severity: "high" cvss: null epss: null exploited: false status: "open" category: "runtime" products: [{"name": "bun", "fixed": ["1.4.4"], "affected": "< 1.4.4", "ecosystem": "npm"}] ecosystems: ["npm"] tags: ["bun", "cwe-295", "javascript", "node", "runtime", "self-hosted", "tls", "typescript"] not_affected_if: ["bun-1.4.4-or-later", "explicit-ca-without-emsign-roots"] published_at: "2026-10-23T02:02:06+00:00" first_seen_at: "2026-11-09T22:53:15+00:00" updated_at: "2026-11-09T22:58:56+00:00" sources: [{"source": "ghsa-repo", "url": "https://github.com/oven-sh/bun/security/advisories/GHSA-26q8-h657-pf84", "first_seen_at": "2026-11-09T22:53:15+00:00"}] exploit_sources: [] --- # Bundled root certificates trust compromised eMudhra (emSign) intermediate CAs Link for people: https://infrastack.ai/live/GHSA-26q8-h657-pf84 (this .md is for agents) Bun 1.4.3 and earlier ship a root certificate store that trusts intermediate certificate authorities from eMudhra (emSign) whose private keys were compromised and revoked. An attacker in the network path can present a forged certificate for any hostname and read or modify traffic, including packages downloaded by bun install. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - npm:bun affected < 1.4.4 fixed 1.4.4 ## How to check - Run `bun --version` and check whether it is below `1.4.4`. - Find `bun build --compile` executables built with an older Bun; they embed the old trust store until rebuilt. - Check whether any connection passes an explicit `ca` list that leaves out the emSign roots, since that connection is protected. ## Fix - Bun: upgrade to `1.4.4` and rebuild any `bun build --compile` executables with it. ## Timeline - 2026-11-09T22:53:15+00:00 ghsa-repo https://github.com/oven-sh/bun/security/advisories/GHSA-26q8-h657-pf84 ## Documents - [advisory] Maintainer's advisory: github.com https://github.com/oven-sh/bun/security/advisories/GHSA-26q8-h657-pf84 - [discussion] Bun 1.4.4 removes compromised eMudhra certs https://news.ycombinator.com/item?id=50206018 ## From the sources ### Summary Bun's bundled root certificates included `emSign ECC Root CA - G3`. Eight eMudhra (emSign) intermediate CAs were revoked for key compromise in October 2026, and the six of them that issue TLS certificates chain to that root. Bun 1.4.3 and earlier accept certificates issued by those intermediates. The private keys have been independently recovered by multiple people and some have been disclosed publicly, so any attacker in the network path can impersonate any TLS server to Bun. Bun 1.4.4 removes the root from the bundle and rejects any certificate chain that contains one of the eight compromised public keys. This is a compromise of a certificate authority's keys, not a bug in Bun's certificate validation. Other projects that ship their own trust store were affected in the same way. ### Details Any TLS client connection that uses Bun's default trust store is affected. That includes `fetch`, `bun install`, `bun add`, `bunx`, `node:https`, `node:tls`, `WebSocket`, `Bun.connect` and `fetch` over HTTP/3. A TLS server that sets `requestCert: true` without a `ca` also verifies client certificates against the default trust store, so it is affected in the same way. Bun checks revocation only against a CRL passed in the `crl` option, so the CA's revocation of the intermediates does not protect affected versions by default. Executables built with `bun build --compile` embed the Bun runtime and its trust store. An executable built with an affected version stays affected until it is rebuilt. ### Impact An attacker in the network path can present a forged certificate that Bun accepts as valid for any hostname. They can then read and modify the traffic. For `bun install` and `bunx` this includes the packages that are downloaded. ### Patches Upgrade to Bun 1.4.4, and rebuild any `bun build --compile` executables with it. Bun 1.4.4 has two changes: - **Three emSign roots are removed and the bundle is updated to NSS 3.131.1** (#46159, #46300). This removes `emSign ECC Root CA - G3`, `emSign Root CA - C1` and `emSign ECC Root CA - C3`. `emSign Root CA - G1` stays in the bundle, as it does in NSS 3.131.1. - **A chain that contains one of the eight compromised public keys fails with `CERT_REVOKED`** (#46300). The check matches the key rather than the certificate, and it applies whichever root the chain ends at. It therefore also covers cross-signed copies of the intermediates, roots loaded from the system store, `NODE_EXTRA_CA_CERTS`, `SSL_CERT_FILE`, `SSL_CERT_DIR`, and a `ca` option. It applies to TLS over TCP, the HTTP/3 client and `node:quic`, and to client certificates that a server verifies. `fetch` over HTTP/3 reports the failure as `HTTP3HandshakeFailed`. The list of keys is the one Node.js, Go and Chrome block. ### Workarounds There is no process-wide workaround for affected versions. - `--use-system-ca` and `NODE_USE_SYSTEM_CA=1` do not help. They add the system's certificates to the bundled ones and do not replace them. - Updating the operating system's certificates does not help, for the same reason. - Passing an explicit `ca` (or `tls.ca`) on a connection replaces the default trust store for that connection only. A list that leaves out the emSign roots protects that connection. - `bun install --cafile ` (or `--ca`) does the same for that install. `bunx` does not accept those flags before 1.4.4. - `cafile` under `[install]` in `bunfig.toml` does the same for `bun install`. In `~/.bunfig.toml` it also applies to `bunx`. ### References - https://github.com/oven-sh/bun/pull/46159 - https://github.com/oven-sh/bun/pull/46300 - https://github.com/oven-sh/bun/issues/46526 - Mozilla incident report: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449 - uv: https://github.com/astral-sh/uv/security/advisories/GHSA-hq85-5cpj-mr62 - certifi: https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2 - Go: CVE-2026-111943 - Rust: https://rustsec.org/advisories/RUSTSEC-2026-0381.html, https://rustsec.org/advisories/RUSTSEC-2026-0382.html, https://rustsec.org/advisories/RUSTSEC-2026-0383.html --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_