Skip to content

Bump Node to 24.22.1 to block the compromised eMudhra intermediates - #783

Merged
justinpersaud merged 1 commit into
mainfrom
robert-nodeEmudhraBlocklist
Oct 21, 2026
Merged

justinpersaud merged 1 commit into
mainfrom
robert-nodeEmudhraBlocklist

Conversation

@robertjchen

Copy link
Copy Markdown
Contributor

Details

Bumps Node to 24.22.1, which rejects TLS chains through the eight compromised eMudhra intermediate CAs (nodejs/node#66871). Node uses its own compiled-in root store, so OS ca-certificates updates don't cover it.

Related Issues

For https://github.com/Expensify/Expensify/issues/693812

Manual Tests

  1. Run nvm install and confirm node -v prints v24.22.1.
  2. Run node -e 'fetch("https://dv-g3b-emudhra.we-have-a-problem.com/").then(r=>console.log(r.status)).catch(e=>console.log(e.cause?.code))'.
  3. Confirm it prints CERT_REVOKED.

Linked PRs

N/A

@github-actions

github-actions Bot commented Oct 21, 2026 •

Copy link
Copy Markdown

All contributors have signed the CLA ✍️ ✅
Posted by the CLA Assistant Lite bot.

@robertjchen

Copy link
Copy Markdown
Contributor Author

I have read the CLA Document and I hereby sign the CLA

exfy-clabot Bot added a commit to Expensify/CLA that referenced this pull request Oct 21, 2026
@justinpersaud
justinpersaud merged commit 297ae79 into main Oct 21, 2026
7 of 9 checks passed
@justinpersaud
justinpersaud deleted the robert-nodeEmudhraBlocklist branch October 21, 2026 17:55
@os-botify

os-botify Bot commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

🚀 Published to npm in 0.1.344 🎉

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants